Remove $this->Auth->allow()
Use Auth::allow() instead of Auth::deny()