CakePHP 1.3: getting authError message on successful login -

i'm trying implement login feature user can use username or email address. i've worked out login both, when user logs in email address, autherror still flashes (user logged in). i've put comment "here" down in login action, , i'm not sure happens after redirect.

here relevant bits of code:

app controoler:

public $components = array(     'auth' => array(         'authorize' => 'controller',         'loginredirect' => array(             'controller' => 'users',             'action' => 'welcome_page'         ),         'loginerror' => 'invalid user name/password',         'autherror' => 'you don\'t have permission'     ),      'session', ); 

user controller:

public function beforefilter() {      parent::beforefilter();      $this->auth->allow('add'); }  public function login() {             // @ point, auth component unable log in user, check email.     if (!empty($this->data) &&         !empty($this->auth->data['user']['username']) &&         !empty($this->auth->data['user']['password'])) {                  // user email address using entered username         $user = $this->user->find('first', array(             'conditions' => array(                 'user.email' => $this->auth->data['user']['username'],                 'user.password' => $this->auth->data['user']['password']             ),             'recursive' => -1         ));          // check if matching user found , if login succesfull         if (!empty($user) && $this->auth->login($user)) {                     if ($this->auth->autoredirect) {                 // note: user trying log in email reaches here                 $this->redirect($this->auth->redirect());   // default authentication redirect defined in app controller             }           } else {             $this->session->setflash($this->auth->loginerror, $this->auth->flashelement, array(), 'auth');         }     }  } 

i edited original post delete messages session variables.

<?php  $this->session->delete('message.flash'); $this->session->delete('message.auth');  ?> 

hope helps!

-andrew