code: private boolean passes(final AuthScope scope, final AuthConstraint constraint, final CurrentUser user)
  	{
  		if (scope.getSkip(constraint))
  		{
  			if (log.isTraceEnabled())
  				log.trace("Allowing method invocation (skip=true).");
  
  			return true;
  		}
  		else
  		{
  			final boolean pass = user.hasRole(scope.getRole(constraint));
  
  			if (log.isTraceEnabled())
  				if (pass)
  					log.trace("Allow method invocation: user " + user + " has role " + scope.getRole(constraint));
  				else
  					log.trace("Deny method invocation: user " + user + " does not have role " + scope.getRole(constraint));
  
  			return pass;
  		}
  	}
docs: Determines whether a given user has the necessary role to pass a constraint
  
  @param constraint
  the constraint to use to test the user
  @param user
  the current user
  
  @return true if the user passes, otherwise false