Need to set AuthComponent::$sessionKey to false to ensure session is not started when no or incorrect credentials are passed for basic/digest auth.