Update Authentication tutorial

After @rightnowweb's most recent pull requests, I thought something fishy might be up with the AuthComponent docs. Turns out there was lots of incorrect code and separate API docs. This fixes all that cruft up.
The previous statement was correct. `allow()` doesn't take `*` as param anymore.