bugfix: correct path in authentication cookie