code: @Override
      public WebReply checkPrecludedAccess(WebRequest webRequest, String uriName) {
          WebReply webReply = null;
          if (webRequest.isAccessPrecluded()) {
              webReply = new DenyReply("Access is precluded because security constraints are specified, but the required roles are empty.");
          } else if (MatchResponse.DENY_MATCH_RESPONSE.equals(webRequest.getMatchResponse())) {
              webReply = new DenyReply("Http uncovered method found, denying reply.");
          } else {
              HttpServletRequest req = webRequest.getHttpServletRequest();
              List<String> requiredRoles = webRequest.getRequiredRoles();
  
              String defaultMethod = (String) req.getAttribute("com.ibm.ws.webcontainer.security.checkdefaultmethod");
              if ("TRACE".equals(defaultMethod) && requiredRoles.isEmpty()) {
                  webReply = new DenyReply("Illegal request. Default implementation of TRACE not allowed.");
              }
          }
          return webReply;
      }
docs: Access precluded explicitly specified in the security constraints or
  by the usage of the com.ibm.ws.webcontainer.security.checkdefaultmethod attribute.
  This attribute is set by the web container in ServletWrapper.startRequest() with the
  intent of blocking hackers from crafting an HTTP HEAD method to bypass security constraints.
  See PK83258 for full details.
  This method also checks for uncovered HTTP methods