code: private boolean isUserAuthorized(HttpServletRequest httpRequest) {
  		if (authorizedUsers == null) {
  			return true;
  		}
  		// Get Authorization header
  		final String auth = httpRequest.getHeader("Authorization");
  		if (auth == null) {
  			return false; // no auth
  		}
  		if (!auth.toUpperCase(Locale.ENGLISH).startsWith("BASIC ")) {
  			return false; // we only do BASIC
  		}
  		// Get encoded "user:password", comes after "BASIC "
  		final String userpassEncoded = auth.substring("BASIC ".length());
  		// Decode it
  		final String userpassDecoded = Base64Coder.decodeString(userpassEncoded);
  
  		final boolean authOk = authorizedUsers.contains(userpassDecoded);
  		return checkLockAgainstBruteForceAttack(authOk);
  	}
docs: Check if the user is authorized, when using the "authorized-users" parameter
  @param httpRequest HttpServletRequest
  @return true if the user is authorized