access: fix access_ticket_verify2() when using non-default webroot

I have just found another issue related to a non-default webroot (the context of this problem is the same as in #563).
The problem is, that `access_ticket_verify2()` does not consider `tvheadend_webroot`.
For instance, a ticket might have been issued for the resource `/stream/channelid/123`, while a client will request the resource `/tvheadend/stream/channelid/123` (i.e., if tvheadend is started with `--http_root /tvheadend`).
As a result, `access_ticket_verify2()` will (wrongly) deny the request.