components/AccessControl.php
protected function denyAccess($user)
	{
		if ($user->getIsGuest()) {
			$user->loginRequired();
		} else {
			throw new \yii\web\ForbiddenHttpException(Yii::t('yii', 'You are not allowed to perform this action.'));
		}
	}
protected function denyAccess($user)
	{
		if ($user->getIsGuest()) {
			$user->loginRequired();
		} else {
			throw new \yii\web\ForbiddenHttpException(Yii::t('yii', 'You are not allowed to perform this action.'));
		}
	}
Denies the access of the user.
The default implementation will redirect the user to the login page if he is a guest;
if the user is already logged, a 403 HTTP exception will be thrown.

@param User $user the current user
@throws HttpException if the user is already logged in.