code: public boolean isAuthorized(HttpServletRequest req) {
  		if(all)return true;
  		if(roles!=null) {
  			for(String srole : roles) {
  				if(req.isUserInRole(srole)) return true;
  			}
  		}
  		return false;
  	}
docs: Check for Authorization when set.
  
  If no Roles set, then accepts all users
  
  @param req
  @return