docs: protected final boolean isAuthorized(HttpServletRequest req) throws Exception {
  
          /*
           * This is sensitive data;  we must verify that the user
           * has the appropriate level of access to see it...
           */
  
          // STEP (1):  Is there an IPerson?
          final IPerson person = personManager.getPerson((HttpServletRequest) req);
          if (person != null) {
  
              // STEP (2):  Is the person authenticated?
              final ISecurityContext securityContext = person.getSecurityContext();
              if (securityContext != null && securityContext.isAuthenticated()) {
  
                  // STEP (3):  Does this user have SUBSCRIBE permission for permissionsAdminChannel?
                  IAuthorizationPrincipal principal =
                          authorizationService.newPrincipal(
                                  (String) person.getAttribute(IPerson.USERNAME), IPerson.class);
  
                  final IPortletDefinition permissionsAdminPortlet =
                          portletDefinitionRegistry.getPortletDefinitionByFname(
                                  PERMISSIONS_ADMIN_PORTLET_FNAME);
                  if (permissionsAdminPortlet == null) {
                      return false;
                  }
  
                  final String portletId =
                          permissionsAdminPortlet.getPortletDefinitionId().getStringId();
                  if (authorizationService.canPrincipalSubscribe(principal, portletId)) {
                      return true;
                  }
              }
          }
  
          return false;
      }