cakephp/cakephp — comment on commit 321caf6db6517b0b053aa8c26b5edcf498fd34f9
File: lib/Cake/Controller/Component/AuthComponent.php line 317
By ADmad:

Hmm, "here" includes the url base, so if the app is running in a subfolder when this session value is used for redirection the url base would be added twice I think.