Last weekend I discovered something I was not aware that it works that way: that code defined after a redirect is executed. A simple example:

class UsersController extends AppController
{
    function beforeFilter()
    {
        // not logged in, so redirect to the login page
        $this->redirect('/login');
    }

    function delete($id)
    {
        $this->User->delete($id);
    }
}

This example redirects _and_ removes the specified user even if you are not logged in (you just have to know the url to delete users). To fix that potential security hole you have to add an exit() after the redirect:

function beforeFilter()
{
    // not logged in, so redirect to the login page
    $this->redirect('/login');
    exit();
}