code: func AllowedWithAuth(am AuthMode, req *http.Request, op Operation) bool {
  	if op&OpUpload != 0 {
  		// upload (at least from pk-put) requires stat and get too
  		op = op | OpVivify
  	}
  	return am.AllowedAccess(req)&op == op
  }
docs: // AllowedWithAuth returns whether the given request
  // has access to perform all the operations in op
  // against am.