title: User management system in CakePHP 2.x behaves strange
body: <p>I am using CakePHP 2.3.6. In one project, I have to implement <code>User Management System</code> for multiple kind of users(<code>Users, Admins, etc.</code>). For now, I only concerned about <code>Admin Panel(only 1 Admin for now)</code> and <code>User Panel</code>. I want that <code>Admin</code> can access all areas(including <code>User Panel</code>'s all pages), and <code>Users</code> will have to <code>login</code> to access certain areas(pages), as usual.</p>
  
  <p>I created 2 <code>controllers</code> for <code>Admin Panel</code> and <code>User Panel</code>, instead of having different <code>plugins</code> for different <code>user panels</code>. Here is the full project's code :</p>
  
  <pre><code>AppController.php :
  
  public $components=array('Session','RequestHandler','Auth');
  public function isAuthorized($user){
      if(isset($user['role']) &amp;&amp; $user['role']==='admin')
          return true;
      return false;
  }
  
  UsersController.php :
  
  public function beforeFilter(){
      parent::beforeFilter();
      $this-&gt;Auth-&gt;loginRedirect=array('action'=&gt;'editProfile');
      $this-&gt;Auth-&gt;logoutRedirect=array('action'=&gt;'index');
      $this-&gt;Auth-&gt;authenticate=array('Form'=&gt;array('scope'=&gt;array('User.role'=&gt;"user"),'userModel'=&gt;'User','fields'=&gt;array('username','password')));
      $this-&gt;Auth-&gt;unauthorizedRedirect=array('action'=&gt;'login');
      $this-&gt;Auth-&gt;loginAction=array('action'=&gt;'login');
      $this-&gt;Auth-&gt;deny('editCv','logout');
      $this-&gt;layout='user_layout';
  }
  public function login(){
      if($this-&gt;request-&gt;is('post'))
          if($this-&gt;Auth-&gt;login()){
              $this-&gt;Session-&gt;setFlash('Welcome '.$this-&gt;User-&gt;field('name',array('User.id'=&gt;$this-&gt;Auth-&gt;user('id'))));
              $this-&gt;redirect($this-&gt;Auth-&gt;redirect());
          }else{
              $this-&gt;Session-&gt;setFlash('Invalid username or password, please try again');
              $this-&gt;set('title_for_layout','Error - Login');
          }
  }
  public function logout(){
      $this-&gt;redirect($this-&gt;Auth-&gt;logout());
  }
  
  AdminsController.php
  
  public function beforeFilter(){
      parent::beforeFilter();
      $this-&gt;Auth-&gt;loginRedirect=array('action'=&gt;'myJobs');
      $this-&gt;Auth-&gt;logoutRedirect=array('action'=&gt;'index');
      $this-&gt;Auth-&gt;authenticate=array('Form'=&gt;array('scope'=&gt;array('User.role'=&gt;"admin"),'userModel'=&gt;'User','fields'=&gt;array('username','password')));
      $this-&gt;Auth-&gt;authError='Did you really think you are allowed to see that ?';
      $this-&gt;Auth-&gt;unauthorizedRedirect=array('action'=&gt;'index');
      $this-&gt;Auth-&gt;loginAction=array('action'=&gt;'index');
      $this-&gt;Auth-&gt;deny('myUsers','deleteUser','logout');
      $this-&gt;layout='admin_layout';
  }
  public function index(){
      if($this-&gt;request-&gt;is('post'))
          if($this-&gt;Auth-&gt;login()){
              $this-&gt;Session-&gt;setFlash("&lt;p style='margin-left:20px;color:#366;'&gt;&lt;strong&gt;Welcome Admin, You have successfully entered to your Admin Panel!&lt;/strong&gt;&lt;/p&gt;");
              $this-&gt;redirect($this-&gt;Auth-&gt;redirect());
          }else{
              $this-&gt;Session-&gt;setFlash('Invalid username or password, please try again');
              $this-&gt;set('title_for_layout','Error - Login');
          }
      else
          $this-&gt;set('title_for_layout','Admin');
      $this-&gt;layout=false;
  }
  public function logout(){
      $this-&gt;redirect($this-&gt;Auth-&gt;logout());
  }
  </code></pre>
  
  <p>Here, I am implementing <code>login</code> in both panels individually, because I have 2 different <code>login pages</code> for both panels. That's why I configured <code>AuthComponent</code> in 2 panels individually.</p>
  
  <p>Now, what's happening is, in the <code>User panel(UsersController)</code>, a user cant access any page without logging in, but I want that my users will see the <code>index</code> page without login.</p>
  
  <p>And, when I login from <code>Admin panel</code>(AdminsController), it gets me to the <code>User panel(UsersController)</code>'s <code>login</code> page, saying that I successfully entered to my Admin panel, but I still cant access admin panel.</p>
  
  <p>I tried <code>$this-&gt;Auth-&gt;authorize('Controller')</code>, but same result. I thought <code>allow()</code> or <code>deny()</code> function will be enough here, but don't know what's going on, what is my fault.</p>
  
  <p>Before I manually implemented <code>login/logout</code> system using <code>Session</code>, and it was working fine. Then I thought to use <code>AuthComponent</code>, but its driving me crazy.</p>
  
  <p>Can anyone help me, please ?</p>
  
  <p>Thanks</p>