OK I have the answer. It isnt anything to do with htaccess or routing. This is a authenticate issue as I thought it would be.
*property *AuthComponent::$unauthorizedRedirect Controls handling of unauthorized access. By default unauthorized user is redirected to the referrer URL or AuthComponent::$loginAction or ‘/’. If set to false a ForbiddenException exception is thrown instead of redirecting. -- Like Us on FaceBook https://www.facebook.com/CakePHP Find us on Twitter http://twitter.com/CakePHP --- You received this message because you are subscribed to the Google Groups "CakePHP" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at http://groups.google.com/group/cake-php. For more options, visit https://groups.google.com/d/optout.
