My controller methods serve dual purpose: To both handle traditional browser requests AND to interact via REST clients using mapped resources.
Case: This is convenient because I can keep all of my validation centralized in Cake models and still have nice ajax forms that I can validate by extracting Model::validationErrors and adding them to the json response. Where I don't care if a form is ajax, I can simply NOT apply my client-side javascript and the form and server communicate normally.
Problem: Many controller actions rely on Controller::redirect(). By overriding redirect(), trying beforeRedirect(), etc, I can find NO reliable way to convert the redirect into a JSON response during an ajax request that would indicate something like 'redirectUrl' => 'foo' so that my client (in the case of browser ajax) can forward the user to a new url using javascript location redirect.
I thought I had it working but realized that unauthorized users had access to run protected resources despite not seeing their output.