protected function _authRequired(Controller $controller)
    {
        $request = $controller->getRequest();
        if (is_array($this->_config['requireAuth']) &&
            !empty($this->_config['requireAuth']) &&
            $request->getData()
        ) {
            deprecationWarning('SecurityComponent::requireAuth() will be removed in 4.0.0.');
            $requireAuth = $this->_config['requireAuth'];

            if (in_array($request->getParam('action'), $requireAuth) || $requireAuth == ['*']) {
                if ($request->getData('_Token') === null) {
                    throw new AuthSecurityException('\'_Token\' was not found in request data.');
                }

                if ($this->session->check('_Token')) {
                    $tData = $this->session->read('_Token');

                    if (!empty($tData['allowedControllers']) &&
                        !in_array($request->getParam('controller'), $tData['allowedControllers'])) {
                        throw new AuthSecurityException(
                            sprintf(
                                'Controller \'%s\' was not found in allowed controllers: \'%s\'.',
                                $request->getParam('controller'),
                                implode(', ', (array)$tData['allowedControllers'])
                            )
                        );
                    }
                    if (!empty($tData['allowedActions']) &&
                        !in_array($request->getParam('action'), $tData['allowedActions'])
                    ) {
                        throw new AuthSecurityException(
                            sprintf(
                                'Action \'%s::%s\' was not found in allowed actions: \'%s\'.',
                                $request->getParam('controller'),
                                $request->getParam('action'),
                                implode(', ', (array)$tData['allowedActions'])
                            )
                        );
                    }
                } else {
                    throw new AuthSecurityException('\'_Token\' was not found in session.');
                }
            }
        }

        return true;
    }