code: protected static boolean isAuthorised(final Http.RequestHeader request)
      {
          return request.attrs().getOptional(ACTION_AUTHORISED).orElse(false);
      }
docs: Checks if an action is authorised.  This allows controller-level annotations to cede control to method-level annotations.
  
  @param request the request
  @return true if a more-specific annotation has authorised access, otherwise false