code: public boolean isProtected() {
          List<String> requiredRoles = null;
          return !webRequest.isUnprotectedURI() &&
                 webRequest.getMatchResponse() != null &&
                 (requiredRoles = webRequest.getRequiredRoles()) != null &&
                 !requiredRoles.isEmpty();
      }
docs: The request is protected if there are required roles
  or it's not mapped everyones role
  @return true if there is a proected url.