CakePHP had an issue with unserialize() at one point. Since then we've wised up about using putting user data into unserialize()