Expose default path via api

So far we had been applying the default `path: '/'` as sort of a
"hidden" default, and it wasn't exposed in the defaults object
accessible as `Cookies.defaults`. This is rather unexpected and we start
exposing the path as part of the defaults to avoid surprises. This
change will also make it slightly more intuitive to change the behavior
to a browser's default behavior where a cookie is only valid at the
current page: instead of having to specify `path: ''` in the defaults we
can now do `delete Cookies.defaults.path`. The former is rather
obfuscating the intent, and a leaking abstraction.

Fixes #541

src/js.cookie.mjs

@@ -15,20 +15,15 @@ function decode (s) {
 }
 
 function init (converter) {
-  var defaults = {}
+  var defaults = {
+    path: '/'
+  }
 
   function set (key, value, attributes) {
     if (typeof document === 'undefined') {
       return
     }
-
-    attributes = extend(
-      {
-        path: '/'
-      },
-      defaults,
-      attributes
-    )
+    attributes = extend(defaults, attributes)
 
     if (typeof attributes.expires === 'number') {
       attributes.expires = new Date(new Date() * 1 + attributes.expires * 864e5)

test/tests.js

@@ -318,7 +318,7 @@ QUnit.test('API for changing defaults', function (assert) {
     Cookies.set('c', 'v').match(/path=\/foo/),
     'should use attributes from defaults'
   )
-  Cookies.remove('c', { path: '/foo' })
+  Cookies.remove('c')
 
   assert.ok(
     Cookies.set('c', 'v', { path: '/bar' }).match(/path=\/bar/),
@@ -327,10 +327,9 @@ QUnit.test('API for changing defaults', function (assert) {
   Cookies.remove('c', { path: '/bar' })
 
   delete Cookies.defaults.path
-  assert.ok(
-    Cookies.set('c', 'v').match(/path=\//),
-    'should roll back to the default path'
-  )
+  assert.notOk(Cookies.set('c', 'v').match(/path=/), 'should not set any path')
+  Cookies.remove('c')
+  Cookies.defaults.path = '/'
 })
 
 QUnit.test('true secure value', function (assert) {