.htaccess 删除特定操作的htpasswd保护

我有一个网站在CakePHP3与htpasswd保护。我想访问不带密码的特定操作，例如/api/models

我可以通过在webroot/.htaccess文件中放置以下代码来删除特定文件中的密码保护，但如何在cakephp 3中实现特定操作的密码保护

<Files "test.php">
    Satisfy Any
</Files>

满足任何

我想如果我必须这样做，我会在控制器中这样做。在cakephp中，我们可以轻松地选择身份验证选项，包括基本身份验证

class AppController extends Controller
{

    public function initialize() {

        parent::initialize();

        $this->loadComponent('Auth', [
            'authenticate' => [
                'Basic' => [
                    'fields' => [
                        //  username and password from database
                        'username' => 'email', 
                        'password' => 'password'
                    ],
                ],
            ],
            'storage' => 'Memory',
            'unauthorizedRedirect' => false
        ]);     

        /**
         *  Allowed actions
         *  ['Controller' => ['method' => 1, 'method' => 1]]
         */
        $excluded_actions = [
            'Users' => [
                'index' => 1, 
                'edit' => 1
            ]
        ];

        $controller = $this->request->getParam('controller');
        $method = $this->request->getParam('action');

        if(isset($excluded_actions[$controller]) && isset($excluded_actions[$controller][$method])) {

            $this->Auth->allow();
        }

    }
}