code: @SuppressWarnings("unchecked")
      protected List<String> mergeRoles(List<String> otherRoles, boolean mergedAccessPrecluded) {
          if (mergedAccessPrecluded == true || roles.isEmpty() || otherRoles.isEmpty()) {
              return Collections.EMPTY_LIST;
          }
          Set<String> tempRoles = new HashSet<String>();
          tempRoles.addAll(otherRoles);
          tempRoles.addAll(roles);
          List<String> mergedRoles = new ArrayList<String>();
          mergedRoles.addAll(tempRoles);
          return mergedRoles;
      }
docs: Based on the Servlet 3.0 specs, precluded takes precedence, and then
  no roles precedes any role mapping.
  <pre>
  1. Precluded
  2. No roles
  3. Specified roles
  </pre>
  
  @param otherRoles
  @param mergedAccessPrecluded
  @return The merged roles.