I assume you're talking about AJAX requests? I'm not sure what is best practice, but I use one controller for all non-authenticated AJAX requests and one controller for all authenticated AJAX requests. I try to push off most of the work to the models so the controller isn't doing much work...
My controllers say "OK, you're authenticated, here's the response the UI expects, now get the data the UI expects from the model."