Seems that this is a known problem. I found some Threads here.
https://discourse.cakephp.org/t/handling-forbidden-exception-for-request-authorization-middleware/6708
https://discourse.cakephp.org/t/redirect-to-last-visited-page-after-authorization-fail/10598