    public function authenticate(CakeRequest $request, CakeResponse $response)
    {
        return self::getUser($request);
    }
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.