Add #1656 Restrict ACP session cookie to /admin path (or other)

#1656