protected function _findUser($username, $password = null)
    {
        $userModel = $this->_config['userModel'];
        list($plugin, $model) = pluginSplit($userModel);
        $fields = $this->_config['fields'];

        $conditions = [$model . '.' . $fields['token'] => $username];
        if (!empty($this->_config['scope'])) {
            $conditions = array_merge($conditions, $this->_config['scope']);
        }
        $table = TableRegistry::get($userModel)->find('all');
        if ($this->_config['contain']) {
            $table = $table->contain($this->_config['contain']);
        }

        $result = $table
            ->where($conditions)
            ->hydrate(false)
            ->first();

        if (empty($result)) {
            return false;
        }

        unset($result[$fields['password']]);

        return $result;
    }