Verify that any existing session path is correct and avoid trying to …

[EreMaijala]

…set an empty path for the session cookie.

We have cases where there is a common VuFind instance in domain root and sub-instances in subdirectories. Currently, if a user enters the common instance first, he'll get a session cookie with '/' as the path, and it will also be used for the sub-instances. This causes trouble when e.g. login methods differ between the instances. Since the cookie headers a browser sends don't include information on the cookie path, this PR adds storing of the path to the session and verification of its correctness. This of course applies in practice only when [Session] limit_by_path is enabled.

The other small change is to ensure that an empty path is never used, otherwise Zend will throw an InvalidArgumentException. That would have happened with VuFind installed in domain root with limit_by_path enabled.

[EreMaijala]

Note: unfortunately it seems there's no equivalent for session_unset() in ZF's SessionManager, and session writes are temporarily disabled when creating a new session since PHP's documentation says PHP 7 will write the old session on session_regenerate_id().

[demiankatz]

Looks reasonable to me; I've backported to release-3.1.