It depends how your widget is implemented - is it an OpenSocial gadget, External Content Widget, or Viewlet? If it's one of the first two, or if it's implemented as a simple iframe pointing to the remote server, then browser security will prevent you from reaching out and finding out who is logged into the page that contains the iframe. If you're creating the iframe yourself, then you could pass in the user id in a URL parameter for the iframe so that it can read it, but you may not have this luxury depending on how you implemented it.

The best approach is to actually authenticate with your own server, so that it knows independently of the Jazz server who you are. This is the most secure option as you wouldn't be able to circumvent this easily and inject another users id in there for the POST. The server would essentially get the user principal from the app container based on the session cookie, or whatever authentication method you use.

The following enhancement is to track the proper solution for getting the user id in a gadget:
Provide a simple way to get current user id from an OpenSocial gadget (244518)

As a temporary workaround, if you don't use lock domain support (hosting the gadget under another hostname/domain for security), then you can actually reach up and grab the user id from the parent window. Here's a quick hack you can use until the real solution comes along:

window.top.com.ibm.team.repository.web.client.session.getAuthenticatedUserId()

This should work in RTC as long as you're not using lock domain. You have to call this from the gadget itself, e.g. here's a test gadget that just prints out the user id:

<?xml version="1.0" encoding="UTF-8"?>
<Module>
    <ModulePrefs title="Test" height="300">
    </ModulePrefs>
    <Content type="html">
        &lt;script type="text/javascript"&gt;
            alert(window.top.com.ibm.team.repository.web.client.session.getAuthenticatedUserId());
        &lt;/script&gt;
    </Content>
</Module>

So if you have another iframe you're using inside there, you can tack that onto the iframe URL and read it from inside the iframe.

 An alternative which would not require reaching across the iframe/document boundary is to use the 'st' param from the iframe url.