Move 'Auth.redirect' session value clearing from AuthComponent::shutdown...

...() to prevent unnecessary session start.

Refs [#3702](https://cakephp.lighthouseapp.com/projects/42648/tickets/3702-AuthComponent-still-starts-the-session-on-an-allowed-action)