$this->Auth->allow('*') doesn't work in 2.1, change to $this->Auth->allow();