code: function(method, user, req) {
      var acl = this._cachedFullEndpointAcl
      if (acl === undefined) {
        acl = this._computeFullEndpointAcl()
        this._cachedFullEndpointAcl = acl
      }
  
      if (!acl) { // if no ACL we authorize
        return true
      }
  
      return acl.hasPermission(user, method, { req: req, endpoint: this })
    }
docs: ***************************************************************************
  @method isOperationAuthorized
  @description Tests whether an operation is authorized given a user (as
  returned by the root authenticator) and any {@link
  carbond.security.Acl} that may apply to this endpoint
  
  @param {string} method -- The HTTP method corresponding to the operation
  that we are attempting to authorize
  @param {Object} user -- The user object
  @param {carbond.Request} req -- The request object
  @returns {boolean} -- Whether of not the operation is authorized