CakePHP是使用AJAX调用授权的

Question

I'm working in app with cakephp 2.6 that using ajax call, controller action changes value in database.

These are my functions in controller

public function on() {
    $this->autoRender = false;
    $this->Doc->id=$this->request->data['id'];
    $this->Doc->saveField("private",1);
    return true; 

} 

public function off() {
    $this->autoRender = false;
    $this->Doc->id=$this->request->data['id'];
    $this->Doc->saveField("private",0);
    return true;  
} 

I call these functions with this code in my view:

$('.flat-toggle').on('click', function() {
  if ($(this).hasClass('on')) {
    $.ajax({
      url : 'docs/off',
      type: 'POST',
      dataType: 'json',
      data: {id:"<?php echo $doc['Doc']['id']?>"},
      success : function(data){
        $('.flat-toggle').removeClass('on');
      },
      error : function(data){
        console.log(data);
      }
    });
  } else {
    $.ajax({
      url : 'docs/on',
      type: 'POST',
      dataType: 'json',
      data: {id:"<?php echo $doc['Doc']['id']?>"},
      success : function(data){
        $('.flat-toggle').addClass('on');
      },
      error : function(data){
        console.log(data);
      }
    });
  }
});

But this only works when I add functions in beforeFilter:

function beforeFilter() {
        $this->Auth->authenticate = array('Ldap');
        $this->Auth->allow('on','off');
        parent::beforeFilter();
    }

I use isAuthorized and I think don't working with ajax call.

How can I use this code without allow functions?

Thanks in advance