Решение (спасибо ndm):
use Cake\ORM\TableRegistry;
...
protected function login($userId = 1)
{
$users = TableRegistry::getTableLocator()->get('Users');
$user = $users->get($userId);
$this->session(['Auth' => $user]);
}
...
$this->login(1);
$this->enableRetainFlashMessages();
$this->get ( '/Users/logout' );
....