How to automatically protect actions

AppController.php

<?php
    /**
     * @param null $user
     * @return bool
     */
    public function isAuthorized($user = null)
    {
        // Admin can access every action
        if ($user && isset($user['is_admin']) && $user['is_admin']) {
            $this->Auth->allow();
            return true;
        }

        // Any registered user can access public functions
        if (empty($this->request->params['prefix'])) {
            return true;
        }

        // Everyone can access api
        if ($this->request->params['prefix'] === 'api') {
            return true;
        }

        // Only admins can access admin functions
        if ($this->request->params['prefix'] === 'admin') {
            return (bool)($user['is_admin']);
        }

        // Default deny
        return false;
    }

UsersController.php

<?php

    /**
     * Initialization hook method.
     *
     * Use this method to add common initialization code like loading components.
     *
     * e.g. `$this->loadComponent('Security');`
     *
     * @return void
     */
    public function initialize()
    {
        parent::initialize();
        $this->Auth->allow(['logout', 'register', 'reset', 'confirm', 'view']);
    }