Users Controller with strange bug

<?php

App::import ('Sanitize');

class UsersController extends AppController {
    var $name = 'Users';

    var $uses = array (
        'User',
        'Student',
        'Company'
    );

    function beforeFilter () {
        parent::beforeFilter();

        $this->Auth->allow (array (
            'login', 'logout', 'validate_email'
        ));
    }

    public function login () {
        $this->set ('title_for_layout', 'ARE · Gestió de Pràctiques externes');
        $this->set ('header_text', 'ARE · Gestió de Pràctiques externes');

        if (isset ($this->data) && $this->Auth->login ($this->data) == 0) {
            $this->set ('cleanLogin', false);
        } else {
            $this->set ('cleanLogin', true);
        }
    }

    public function logout () {
        $this->Session->delete ('Role');
        $this->Auth->logout ();
        $this->redirect(array(
            'controller' => 'users',
            'action' => 'login'
        ));
    }

    public function dashboard () {
        $this->set ('title_for_layout', 'ARE · Panell de gestió');
        $this->set ('header_text', 'ARE · Panell de gestió');

        $userinfo = $this->Auth->user ();

        $groupid = $userinfo['User']['group_id'];
        $dashboard = $this->requestAction (
            array (
                'controller' => $this->group_numbers[$groupid],
                'action' => 'dashboard'
            ),
            array (
                'named' => array (),
                'pass' => array (),
                'return'
            )
        );

        $this->set ('dashboard', $dashboard);
    }

    public function validate_email () {
        if (count ($this->params) < 2) {
            $this->redirect (array(
                'controller' => 'users',
                'action' => 'dashboard'
            ));
        }

        $username = Sanitize::paranoid (
            $this->params['pass'][0],
            array ('_')
        );
        $code = Sanitize::paranoid (
            $this->params['pass'][1],
            array ('-', '.')
        );

        $db_code = $this->User->field (
            'validate',
            array (
                'username' => $username,
            )
        );

        if ($db_code == 'v:'.$code) {
            $this->set ('title_for_layout', 'ARE · Validació d\'usuari');
            $this->set ('header_text', 'ARE · Validació d\'usuari');

            $this->User->updateAll (
                array (
                    'validate' => '\'' . $this->genPass (64) . '\''
                ),
                array (
                    'username' => $username
                )
            );

            $this->set ('validated', true);
        } else {
            $this->set ('title_for_layout', 'ARE · Validació incorrecta');
            $this->set ('header_text', 'ARE · Validació incorrecta');
            $this->set ('validated', false);
        }
    }
}