In basic authentication, the username and password are transmitted as . whereas in 1.3 $this->Auth->login($this->data) would try to identify the user first and .. user can access public functions if (empty($this->request->params['admin'])) .