Theres a new safe requestContext available in velocity contexts to get the context path as opposed to using the req (Request) object directly.

Usages of $req.contextPath should be replaced by $requestContext.baseUrl