Per core, isAuthorized is supposed to be a public function, with no underscore as the prefix. https://github.com/cakephp/cakephp/blob/master/lib/Cake/Controller/Component/Auth/ControllerAuthorize.php#L51