Undefined variable: $_SESSION

Turned out there was some extra code in the AppModel that was messing things up: in beforeFind and afterFind: I don’t know why, but that was what the problem was. Removing those lines fixed the issue I was having.