title: unauthorizedRedirect set to false, still redirecting
body: <p>I'm writing some REST api for my cake 3.0 application, and I need to set <code>$this-&gt;Auth-&gt;unauthorizedRedirect</code> to <code>false</code>, as the manual says that this would prevent my application to redirect to login url for unauthorized requests.</p>
  
  <p><a href="http://api.cakephp.org/3.0/class-Cake.Auth.BasicAuthenticate.html" rel="nofollow">http://api.cakephp.org/3.0/class-Cake.Auth.BasicAuthenticate.html</a></p>
  
  <p>The problem is that I'm trying to set it in my Users controller, and it doesn't work:</p>
  
  <pre class="lang-php prettyprint-override"><code>class UsersController extends AppController {
  
  public function initialize() {
      parent::initialize();
      $this-&gt;loadComponent('RequestHandler');
  }
  
  public function beforeFilter(Event $event) {
      parent::beforeFilter($event);
      $this-&gt;Auth-&gt;allow(['logout']);
  
      // Change the authentication mode when using REST api
      if(! $this-&gt;RequestHandler-&gt;accepts('html')) {
          $this-&gt;Auth-&gt;unauthorizedRedirect = false;
  
          $user = $this-&gt;Auth-&gt;identify();
          if ($user) {
              $this-&gt;Auth-&gt;setUser($user);
          }
      }
  }
  </code></pre>
  
  <p>This scripts works fine as detecting if a user is actually registered, but fails when I try to use wrong authentication data, showing the login form instead of throwing an error. What am I doing wrong?</p>