docs: private boolean isAuthorized(AuthorizationConfig config, String verb, String resource, Set<String> userRoles) {
          if (resource == null || resource.trim().length() == 0) {
              resource = "/"; //$NON-NLS-1$
          }
          // If multiMatch is set to 'any', then start out with authorized = false, and we need to
          // find at least one match to turn authorized to true.  If it's set to "all" (the default)
          // then start out authorized, and it requires *every* matching rule to pass or else it'll
          // switch to false.
          boolean authorized = true;
          if (config.getMultiMatch() == MultipleMatchType.any) {
              authorized = false;
          }
          boolean matchFound = false;
          for (AuthorizationRule authorizationRule : config.getRules()) {
              boolean verbMatches = "*".equals(authorizationRule.getVerb()) || verb.equalsIgnoreCase(authorizationRule.getVerb()); //$NON-NLS-1$
              boolean ruleMatches = resource.matches(authorizationRule.getPathPattern());
              if (verbMatches && ruleMatches) {
                  // the verb and resource matched the rule - so enforce the role here!
                  boolean userHasRole = userRoles.contains(authorizationRule.getRole());
                  matchFound = true;
  
                  // If the multiMatch setting is "at least one matching rule" then do a logical
                  // OR operation.  If it's set to "all matching rules" then do a logical AND.
                  if (config.getMultiMatch() == MultipleMatchType.any) {
                      authorized = authorized || userHasRole;
                  } else {
                      authorized = authorized && userHasRole;
                  }
              }
          }
  
          // If no authorization rules matched the request, what do we do?
          if (!matchFound) {
              if (config.getRequestUnmatched() == UnmatchedRequestType.pass) {
                  authorized = true;
              } else {
                  authorized = false;
              }
          }
  
          return authorized;
      }