expireCookie now also requires path argument

According to rfc6265 5.3 step 10 [1], a current cookies standard,
cookies are identified by name, path and domain. Thus to properly expire
cookie you need to provide all. Otherwise these are set to current
domain and path. Which makes current implementation of expireCookie
useless. For example logout in Auth snaplet is broken.

[1]: http://tools.ietf.org/html/rfc6265#page-24
I don't like this because it will break user code.

Instead, could we:

  - mark the existing expireCookie as deprecated
  - have expireCookie set the path to "/"
  - add a new function under a new name with the semantics you suggest