public $components = array(
        'Security' => array(
            'csrfCheck' => false,
            'validatePost' => false,
        )
    );

public function beforeFilter()
    {
        parent::beforeFilter();
        if ($this->request->action === 'your action name')) {
            $this->Security->validatePost = false;
            $this->Security->csrfCheck = false;
        }
    }

public function beforeFilter()
    {
        parent::beforeFilter();
        if ($this->params->action === 'your action name')) {
            $this->Security->validatePost = false;
            $this->Security->csrfCheck = false;
        }
    }

Or

public function beforeFilter()
    {
        parent::beforeFilter();
	if (strpos($this->params->action, 'ajax')) {
	    $this->Security->validatePost = false;
	    $this->Security->csrfCheck = false;
	}
    }	

Validando várias actions pelo nome

$ajaxActions = array(
		'your action 1',
		'your action 2',
		'your action 3',
	);

	if (array_key_exists($this->params->action, $ajaxActions)) {
		$this->Security->validatePost = false;
		$this->Security->csrfCheck = false;
	}

Ajax Example

<script type="text/javascript">

    function saveData() {
        let formUrl = '<?= Router::url(array(
                            'plugin' => false,
                            'admin' => true,
                            'controller' => 'users',
                            'action' => 'save',
                        ), false); ?>
						
		$.ajax({
                url: formUrl,
                cache: false,
				data: { key: 'your data here' }
                success: function(data) {
                    $("#formUser").html(data);
                },
                error: function(err) {
                    console.log('error');
                }
            });				
	}
						
</script>