Yii web service authorization and session

What are the different authorization and session related开发者_运维知识库 measures that should be taken into account when using Yii web services?

ATM I can just think of some security tokens used in connection with database (tokens are stored in DB and checked with the token placed in request, additionally you can store some more info)