subfolder aware session store

session cookie shouldn't be shared between different apps under different subfolders

https://www.openproject.org/work_packages/5632