Simplest possible RBAC for Yii