Warn users against adding login action to allowed actions.
Closes cakephp/cakephp#4271