Estou trabalhando no CakePHP 3.2 e emlogin() ação, deseja permitir o login apenas para aqueles cujo status éverified = 1

public function login()
    {
      if ($this->request->is('post') || $this->request->query('provider')) {
        $user = $this->Auth->identify();
        if ($user) {
          if ($user->verified != 1) {   // LINE 6
            $this->Flash->error(__('You have not yet verified your account. Please check your email to verify your account before login'), [
              'params' => [
                'userId' => $user->id,   // LINE 9
              ],
              ['escape' => false]
            ]);
            $this->redirect(['action' => 'login']);
          }
          $this->Auth->setUser($user);
          $this->_setCookie();
          $this->Flash->success('Login Success');
          return $this->redirect($this->Auth->redirectUrl());
        }
        $this->Flash->error(__('Invalid username or password, try again'));
      }
    }

Mas isso dá erro como

Notice (8): Trying to get property of non-object [APP/Controller/UsersController.php, line 6]
Notice (8): Trying to get property of non-object [APP/Controller/UsersController.php, line 9]
Warning (2): Cannot modify header information - headers already sent by (output started at /var/www/html/argoSystems/projects/project_01/site/vendor/cakephp/cakephp/src/Error/Debugger.php:746) [CORE/src/Network/Session.php, line 572]
Warning (2): session_regenerate_id() [function.session-regenerate-id]: Cannot regenerate session id - headers already sent [CORE/src/Network/Session.php, line 576]

NOTA: o número da linha foi alterado para atender trechos de código