title: CakePHP 3.6 $this->Auth->identify() returning FALSE on newly created data
body: <p>I am currently experiencing some difficulty in fixing my problem. I am new with cakePHP 3 and was assigned to create a blog system (Users, Blogs, Roles) to further my training. The first thing I did was insert the authentication part. Initially, the login was working fine (I made 3 accounts using the /users/add.ctp with hashed passwords via DefaultPasswordHasher and tried to login using each account). After a couple of days of working on the front end design of my website, I created 2 new users, and noticed that $user = $this->Auth->identify() returns false when I try to log either of the new accounts. I tried logging in with one of my old accounts, and $user was defined. For the sake of testing it out, I edited one of the passwords of my old accounts, and tried to login with the new password, and now $user now returns false. </p>
  
  <p>Here is my code:</p>
  
  <pre><code>//App Controller
  $this-&gt;loadComponent('Auth', [
          'authenticate' =&gt; [
              'Form' =&gt; [
                  'fields' =&gt; ['username' =&gt; 'username','password' =&gt; 'password'],
  
              ]
          ],
          'authError' =&gt; 'Please login before continuing.',
          'loginAction' =&gt; ['controller' =&gt; 'Users', 'action' =&gt; 'login'],
          'loginRedirect' =&gt; ['controller' =&gt; 'Blogs', 'action' =&gt; 'index'],
          'logoutRedirect' =&gt;  ['controller' =&gt; 'Users', 'action' =&gt; 'login'],
          'unauthorizedRedirect' =&gt; ['controller' =&gt; 'Users', 'action' =&gt; 'login']
      ]);
  
  public function beforeFilter(Event $event)
  {
      parent::beforeFilter($event);
      $this-&gt;Auth-&gt;allow();
  
  
  
      $this-&gt;set(compact('session_user'));
  }
  </code></pre>
  
  <p>This is my Users Controller login:</p>
  
  <pre><code>public function login()
  {
      $this-&gt;viewBuilder()-&gt;setLayout('login');
  
      if ($this-&gt;request-&gt;is('post')) {
          $user = $this-&gt;Auth-&gt;identify();
          die(pr($user));  //&lt;--To check if identify() catches login details
          if ($user) {
              $this-&gt;Auth-&gt;setUser($user);
              return $this-&gt;redirect($this-&gt;Auth-&gt;redirectUrl());
          }
          else {
              $this-&gt;Flash-&gt;error(__('Username/Password is invalid.'));
              return $this-&gt;redirect($this-&gt;Auth-&gt;config('loginAction'));
          }
      }
  }
  </code></pre>
  
  <p>This is the login.ctp</p>
  
  <pre><code>&lt;div class = "login-container"&gt;
  &lt;div class = "login-div"&gt;
      &lt;div = "login-field"&gt;
          &lt;h1&gt;Login Page&lt;/h1&gt;
          &lt;?= $this-&gt;Form-&gt;create(); ?&gt;
          &lt;?= $this-&gt;Form-&gt;control('username') ?&gt;
          &lt;?= $this-&gt;Form-&gt;control('password', ['type' =&gt; 'password']) ?&gt;
          &lt;?= $this-&gt;Form-&gt;button(__('Login')) ?&gt;
          &lt;?= $this-&gt;Form-&gt;end() ?&gt;
      &lt;/div&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p></p>
  
  <p>This is my User Entity:</p>
  
  <pre><code>class User extends Entity
  {
  
  /**
   * Fields that can be mass assigned using newEntity() or patchEntity().
   *
   * Note that when '*' is set to true, this allows all unspecified fields to
   * be mass assigned. For security purposes, it is advised to set '*' to false
   * (or remove it), and explicitly make individual fields accessible as needed.
   *
   * @var array
   */
  protected $_accessible = [
      'username' =&gt; true,
      'role_id' =&gt; true,
      'email' =&gt; true,
      'password' =&gt; true,
      'created' =&gt; true,
      'modified' =&gt; true,
      'role' =&gt; true,
      'blogs' =&gt; true
  ];
  
  /**
   * Fields that are excluded from JSON versions of the entity.
   *
   * @var array
   */
  protected $_hidden = [
      'password'
  ];
  
  public function _setPassword($value) {
      $hasher = new DefaultPasswordHasher();
      return $hasher-&gt;hash('$value');
  }
  </code></pre>
  
  <p>}</p>
  
  <p>This is my UsersTable:</p>
  
  <pre><code>class UsersTable extends Table
  {
  
  /**
   * Initialize method
   *
   * @param array $config The configuration for the Table.
   * @return void
   */
  public function initialize(array $config)
  {
      parent::initialize($config);
  
      $this-&gt;setTable('users');
      $this-&gt;setDisplayField('id');
      $this-&gt;setPrimaryKey('id');
  
      $this-&gt;addBehavior('Timestamp');
  
      $this-&gt;belongsTo('Roles', [
          'foreignKey' =&gt; 'role_id',
          'joinType' =&gt; 'INNER'
      ]);
      $this-&gt;hasMany('Blogs', [
          'foreignKey' =&gt; 'user_id'
      ]);
      $this-&gt;hasMany('Comments', [
          'foreignKey' =&gt; 'user_id'
      ]);
  }
  
  /**
   * Default validation rules.
   *
   * @param \Cake\Validation\Validator $validator Validator instance.
   * @return \Cake\Validation\Validator
   */
  public function validationDefault(Validator $validator)
  {
      $validator
          -&gt;integer('id')
          -&gt;allowEmpty('id', 'create');
  
      $validator
          -&gt;scalar('username')
          -&gt;maxLength('username', 255)
          -&gt;requirePresence('username', 'create')
          -&gt;notEmpty('username');
  
  
      $validator
          -&gt;email('email')
          -&gt;requirePresence('email', 'create')
          -&gt;notEmpty('email');
  
      $validator
          -&gt;scalar('password')
          -&gt;maxLength('password', 255)
          -&gt;requirePresence('password', 'create')
          -&gt;notEmpty('password');
  
      return $validator;
  }
  
  /**
   * Returns a rules checker object that will be used for validating
   * application integrity.
   *
   * @param \Cake\ORM\RulesChecker $rules The rules object to be modified.
   * @return \Cake\ORM\RulesChecker
   */
  public function buildRules(RulesChecker $rules)
  {
      $rules-&gt;add($rules-&gt;isUnique(['username']));
      $rules-&gt;add($rules-&gt;isUnique(['email']));
      $rules-&gt;add($rules-&gt;existsIn(['role_id'], 'Roles'));
  
      return $rules;
  }
  </code></pre>
  
  <p>}</p>
  
  <p>I inserted the die(pr($user)) after $this->Auth->identify(); at the login function at the User's controller. I am sure that the data is being saved and hashed properly by checking it both at my localhost/phpmyadmin and users/view.ctp, its just that the newly created/edited accounts cannot seem to pass through the login.</p>