The issue is with line 680 of lib/Cake/Controller/Component/AuthComponent.php
return Router::url($redir);
Changing it to the following (which was an update in 2.3.9) fixes it:
return Router::url($redir + array('base' => false));
As does changing it to this (which is an update in 2.4):
return Router::normalize($redir, false);
See commit message here:
https://github.com/cakephp/cakephp/commit/8133f72
Obviously editing the CakePHP core files isn’t a good idea, so I upgraded to 2.3.9 to fix the issue.
solved CakePHP $this->redirect($this->Auth->redirectUrl()); Duplicates BaseURL in Redirect