code: protected User authorize(String path, JSONObject content, Map<String,String> headers)
      throws AuthorizationException {
          User user = null;
          String userId = headers.get(Listener.AUTHENTICATED_USER_HEADER);
          String method = headers.get(Listener.METAINFO_HTTP_METHOD);
          if (userId != null)
              user = UserGroupCache.getUser(userId);
  
          List<String> roles = getRoles(path, method);
          if (roles != null && !roles.isEmpty()) {
              if (user == null) {
                  throw new AuthorizationException(HTTP_401_UNAUTHORIZED, "Service "
                          + getClass().getSimpleName() + " requires authenticated user");
              }
              for (String role : roles) {
                  if (user.hasRole(role)) {
                      return user;
                  }
              }
              throw new AuthorizationException(HTTP_401_UNAUTHORIZED,
                      "User: " + userId + " not authorized for: " + path);
          }
          return null;
      }
docs: The user identified in the AuthenticatedUser headers must be authorized to
  perform this action.  For HTTP, MDW removes this header (if it exists) from
  every request and then populates based on session authentication or HTTP Basic.
  @param content
  
  @return authorized user if successful