I already fixed this long ago in my component. The default jcook code locks you into the JPATH_ROOT and does not allow you to store critical files outside of the web directory. For example:
/home/user/public_html
/home/user/sensitive_files
If the function is locked to the JPATH_ROOT and this happens to be the public_html directory, there is no way you can store files in the sensitive_files directory.
In my opinion you were better off leaving it as it was before, which allowed the user to specify the exact directory on the server. The current model does not let you do that.
You can see this in action on
www.mailborder.com if you like. I use it to manage my user's licenses.