diff --git a/cake/libs/controller/components/security.php b/cake/libs/controller/components/security.php
index d40f50fd0..cb28b6c72 100644
--- a/cake/libs/controller/components/security.php
+++ b/cake/libs/controller/components/security.php
@@ -484,8 +484,8 @@ class SecurityComponent extends Object {
 					}
 				}
 			}
-			$merge = array();
 			foreach ($check as $key => $value) {
+				$merge = array();
 				if ($key === '__Token') {
 					$field[$key] = $value;
 					continue;
@@ -515,8 +515,11 @@ class SecurityComponent extends Object {
 							$merge[] = $lookup;
 						}
 					}
+
 					if (isset($field[$newKey])) {
 						$field[$newKey] = array_merge($merge, $field[$newKey]);
+					} else {
+						$field[$newKey] = $merge;
 					}
 					$controller->data[$newKey] = Set::pushDiff($controller->data[$key], $controller->data[$newKey]);
 					unset($controller->data[$key]);
@@ -601,4 +604,4 @@ class SecurityComponent extends Object {
 		}
 	}
 }
-?>
+?>
\ No newline at end of file