Respect subdirectory in authenticate middleware

Commit d3c641ea31 broke subdirectory support. `req.path` includes the subdirectory, thus may not necessarily start with `"/ghost"`. This strips the subdirectory from the path before the tests are done to ensure the subdirectory is respected.

I don't know if a test could be added that tests subdirectories (particularly sadistic ones that would break unsanitary regex testing) and paths like `/ghost/` and `/ghost/signin/`, but I think that would be helpful. I might look into that if I have time, but I make no promises.