code: function(user, permission, env) {
      if (permission === 'get') {
        return this.hasPermission(user, 'find', env)
      }
      if (permission === 'patch') {
        return this.hasPermission(user, 'update', env)
      }
      if (permission === 'post') {
        // XXX: is this safe?
        if (_.isArray(env.req.body)) {
          return this.hasPermission(user, 'insert', env)
        } else {
          return this.hasPermission(user, 'insertObject', env)
        }
      }
      if (permission === 'delete') {
        return this.hasPermission(user, 'remove', env)
      }
      if (permission === 'head') {
        return this.hasPermission(user, 'find', env)
      }
      if (permission === 'options') {
        return true // XXX I think this is right
      }
      if (permission === 'put') {
        return this.hasPermission(user, 'save', env)
      }
  
      return _o('./EndpointAcl').prototype.hasPermission.call(this, user, permission, env)
  
    }
docs: ***************************************************************************
  @method hasPermission
  @description hasPermission description
  @param {xxx} user -- xxx
  @param {xxx} permission -- xxx
  @param {xxx} env -- xxx
  @returns {xxx} -- xxx