code: private boolean isAuthorized(AuthorizationConfig config, String verb, String resource, Set<String> userRoles) {
          if (resource == null || resource.trim().length() == 0) {
              resource = "/"; //$NON-NLS-1$
          }
          // If multiMatch is set to 'any', then start out with authorized = false, and we need to
          // find at least one match to turn authorized to true.  If it's set to "all" (the default)
          // then start out authorized, and it requires *every* matching rule to pass or else it'll
          // switch to false.
          boolean authorized = true;
          if (config.getMultiMatch() == MultipleMatchType.any) {
              authorized = false;
          }
          boolean matchFound = false;
          for (AuthorizationRule authorizationRule : config.getRules()) {
              boolean verbMatches = "*".equals(authorizationRule.getVerb()) || verb.equalsIgnoreCase(authorizationRule.getVerb()); //$NON-NLS-1$
              boolean ruleMatches = resource.matches(authorizationRule.getPathPattern());
              if (verbMatches && ruleMatches) {
                  // the verb and resource matched the rule - so enforce the role here!
                  boolean userHasRole = userRoles.contains(authorizationRule.getRole());
                  matchFound = true;
  
                  // If the multiMatch setting is "at least one matching rule" then do a logical
                  // OR operation.  If it's set to "all matching rules" then do a logical AND.
                  if (config.getMultiMatch() == MultipleMatchType.any) {
                      authorized = authorized || userHasRole;
                  } else {
                      authorized = authorized && userHasRole;
                  }
              }
          }
  
          // If no authorization rules matched the request, what do we do?
          if (!matchFound) {
              if (config.getRequestUnmatched() == UnmatchedRequestType.pass) {
                  authorized = true;
              } else {
                  authorized = false;
              }
          }
  
          return authorized;
      }
docs: Checks the verb and resource against the requirements configured for the
  policy.  Returns true iff the user has all of the required roles (multiple
  roles may be required depending on configuration).
  
  Note that if the configuration does not include any
  
  @param config
  @param verb
  @param resource
  @param userRoles