code: protected function denyAccess($user)
      {
          if ($user !== false && $user->getIsGuest()) {
              $user->loginRequired();
          } else {
              throw new ForbiddenHttpException(Yii::t('yii', 'You are not allowed to perform this action.'));
          }
      }
docs: Denies the access of the user.
  The default implementation will redirect the user to the login page if he is a guest;
  if the user is already logged, a 403 HTTP exception will be thrown.
  @param User|false $user the current user or boolean `false` in case of detached User component
  @throws ForbiddenHttpException if the user is already logged in or in case of detached User component.