code: private boolean isAuthorized(EventHandler handler, Map<String,String> headers)
      throws AuthorizationException {
          // Exclude unless it is REST or SOAP (i.e. HTTP)
          if (!Listener.METAINFO_PROTOCOL_REST.equals(headers.get(Listener.METAINFO_PROTOCOL)) && !Listener.METAINFO_PROTOCOL_SOAP.equals(headers.get(Listener.METAINFO_PROTOCOL)))
              return true;
  
          String userId = headers.get(Listener.AUTHENTICATED_USER_HEADER);
          User user = null;
  
          List<String> roles = handler.getRoles();
          if (roles != null && !roles.isEmpty()) {
              if (userId != null)
                  user = UserGroupCache.getUser(userId);
              if (user == null)
                  throw new AuthorizationException(ServiceException.NOT_AUTHORIZED, "Event Handler " + handler.getClass().getSimpleName() + " requires authenticated user");
              for (String role : roles) {
                  if (user.hasRole(role))
                      return true;
              }
              throw new AuthorizationException(ServiceException.NOT_AUTHORIZED, "User: " + userId + " not authorized for: " + handler.getClass().getSimpleName());
          }
          return true;
      }
docs: The user identified in the AuthenticatedUser headers must be authorized to
  perform this action.  For HTTP, MDW removes this header (if it exists) from
  every request and then populates based on session authentication or HTTP Basic/Bearer.