code: protected void validateResourceAuthorization(HttpServletRequest req, PrincipalUser actualOwner, PrincipalUser currentOwner) {
          if (!getRemoteUser(req).isPrivileged() && !actualOwner.equals(currentOwner)) {
              throw new WebApplicationException(Status.FORBIDDEN.getReasonPhrase(), Status.FORBIDDEN);
          }
      }
docs: Validates the resource authorization. Throws exception if the user is not authorized to access the resource.
  
  @param   req           The HTTP request.
  @param   actualOwner   The owner of the resource.
  @param   currentOwner  The logged in user.
  
  @throws  WebApplicationException  Throws exception if user is not authorized to access the resource.