code: protected boolean shouldAuthorize(Authentication authentication, Authorizable controlledObject)
      {
          Assert.state(getAccessDecisionManager() != null, "The AccessDecisionManager can not be null!");
          boolean authorize = false;
          try
          {
              if (authentication != null)
              {
                  List<ConfigAttribute> cad = getConfigAttributeDefinition(controlledObject);
                  if (cad != null)
                  {
                      getAccessDecisionManager().decide(authentication, null, cad);
                  }
                  authorize = true;
              } else {
                  // authentication must be disabled, going through
                  authorize = true;
              }
          }
          catch (AccessDeniedException e)
          {
              authorize = false;
              // This means the secured objects should not be authorized
          }
          return authorize;
      }
docs: Determine if our controlled objects should be authorized based on the
  provided authentication token.
  
  @param authentication
  token
  @return true if should authorize