disable saving password with AuthComponent::password
disable allow(*) prevent redirect loop