code: protected List<String> getRoles(String path) {
          List<String> defaultRoles = new ArrayList<String>();
          defaultRoles.add(Workgroup.SITE_ADMIN_GROUP);
          return defaultRoles;
      }
docs: A user who belongs to any role in the returned list is allowed
  to perform this action/method.  Override to open access beyond Site Admin.
  @param path
  @return list of role names or null if authorization not required