Fix EZP-21263: Hardcoded prefix in the JS REST client

Fixed.

We have to make one more unauthorized request to the root resource before a session creation, but I can't see a way around it if we want to auto-discover the "createSession" path.