I'm currently building a stand-alone web site that utilizes ASP.Net MVC 4 and am wondering what the best way to handle action based security in my api controllers.

I've built a lot of sites for my company and have utilized the HttpContext.Current.User construct - but this site will not be using integrated security and don't want to be posting username and session keys manually with every ajax call.