Set default cookie path to app's base path instead of "/".

This allows running multiple apps in subfolders under document root, without
interfering with each other or potentially other non-cake apps on same domain.
I see basically the *same* check occur *three* times in this PR. Would it be better to have `Session` itself have some sensible default/detection?