YII提出的安全Ajax请求

Question

i'm currently writing a Application based on YII.
My action for index:

  public function actionIndex() {
    $data = array();
    $data['server'] = Server::model()->findByPk(1);
    $data['dataProvider'] = new CActiveDataProvider('ServerUserPermission', array('criteria' => array('condition' => 'serverID=:id', 'params' => array(':id' => 1))));
    $this->render('index', $data);
}

my ajax action:

public function actionAddPermission($server) {
    if(Util::checkServerPower($server, Permission::MODIFY_SERVER)) {
        $perm = new ServerUserPermission;
        $perm->userID = 1;
        $perm->serverID = $server;
        $perm->power = 10;
        try {
            if ($perm->save()) {
                echo "OK";
            } else {
                echo Util::print_r($perm->getErrors());
            }
        } catch (Exception $e) {
            echo 'Critical Error Code: ' . $e->getCode();
        }
    } else {
        echo 'No Permissions';
    }
}

My view links to the addPermission action by using a button:

echo CHtml::ajaxButton("Insert New Player", array('addPermission', 'server' => $server->serverID), array('success'=>'refresh')); 

My function Util::checkServerPower(...) checks the current User of the Application. Consequence: Ajax requests in YII are handled by an Guest AuthWeb User, but i need to check whether the User is actually allowed to add permissions or not. I currently cannot think of a secured solution to protect malicious data send by other guests or not. Is it somehow possible to get the (server-side) userID of the Ajax-call?

Thanks anyway sincerly