code: @GET
      @Produces(MediaType.APPLICATION_JSON)
      public List<C> getAll(@Context HttpServletRequest req) {
          if (isRestricted() && !req.isUserInRole("admin")) {
              throw new HttpStatusException(Response.Status.FORBIDDEN);
          }
          List<C> results = new ArrayList<>();
          for (E userEntity : this.dao.getAll()) {
              results.add(toComm(userEntity, req));
          }
          return results;
      }
docs: Gets all objects managed by this resource. By default, only users with
  the <code>admin</code> role are authorized to use this API. Setting
  the <code>restricted</code> field to <code>false</code> in the two-
  argument constructor will change this behavior so that non-admin users
  may also make this API call.
  
  @param req the HTTP servlet request.
  @return the list of objects managed by this resource.
  
  @throws HttpStatusException if an error occurred, for example, the user
  is not authorized to make this call.