Bug 1500774: Use correct path for deleting old sessions

behatnotneeded: dealing with deletign files from dataroot

Change-Id: I0c6f2ef1b04b8ac4beef2daef2459b619db9a9ed
Signed-off-by: Robert Lyon <robertl@catalyst.net.nz>
(cherry picked from commit 4deca621)

htdocs/auth/lib.php

@@ -1876,7 +1876,7 @@ function auth_handle_institution_expiries() {
  * out session files of users whose sessions have timed out.
  */
 function auth_remove_old_session_files() {
-    $basedir = get_config('dataroot') . 'sessions/';
+    $basedir = get_config('sessionpath');
 
     // delete sessions older than the session timeout plus 2 days
     $mintime = time() - get_config('session_timeout') - 2 * 24 * 60 * 60;