CakePHP 2.x无法阻止已删除和禁止的用户登录

public function login() {
    if ($this->request->is('post')) {
        if ($this->Auth->login()) {
            // 获取用户信息
            $user = $this->User->find('first', array(
                'conditions' => array(
                    'User.username' => $this->request->data['User']['username']
                )
            ));
            // 判断用户状态
            if ($user['User']['status'] == 0) {
                $this->Session->setFlash(__('该用户已被删除，无法登录'));
                $this->redirect(array('action' => 'login'));
            } elseif ($user['User']['status'] == 2) {
                $this->Session->setFlash(__('该用户已被禁止登录'));
                $this->redirect(array('action' => 'login'));
            } else {
                $this->redirect($this->Auth->redirect());
            }
        } else {
            $this->Session->setFlash(__('用户名或密码错误，请重试'));
        }
    }
}