code: protected List<String> getRoles(String path, String method) {
          if (method.equals("GET")) {
              List<String> roles = new ArrayList<>();
              // restrict if view access role exists
              if (UserGroupCache.getRole(Role.RUNTIME_VIEW) != null) {
                  roles.add(Role.RUNTIME_VIEW);
                  roles.add(Role.PROCESS_EXECUTION);
                  roles.add(Workgroup.SITE_ADMIN_GROUP);
              }
              return roles;
          }
          return getRoles(path);
      }
docs: Default impl pays no attention to method (for compatibility).
  GET access if restricted if the "Runtime View" role exists.