code: @Override
      public WebReply checkPrecludedAccess(WebRequest webRequest, String uriName) {
          WebReply webReply = null;
          /*
           * In order to check precluded access, WebUserDataPermission can be used,
           * since it is created for a excluded permission if there is no role assigned.
           * That can be used to do a check to return 403 right away instead of prompting
           * or switching protocol from tcp to ssl, and then throwing 403.
           */
          HttpServletRequest req = webRequest.getHttpServletRequest();
          boolean isExcluded = false;
          isExcluded = jaccServiceRef.getService().isAccessExcluded(getApplicationName(), getModuleName(), uriName, req.getMethod(), req);
          if (isExcluded) {
              webReply = new DenyReply("JACC provider denied the access.");
          }
          return webReply;
      }
docs: Access precluded explicitly specified in the security constraints or
  by the usage of the com.ibm.ws.webcontainer.security.checkdefaultmethod attribute.
  This attribute is set by the web container in ServletWrapper.startRequest() with the
  intent of blocking hackers from crafting an HTTP HEAD method to bypass security constraints.
  See PK83258 for full details. <--- ToDo
  This method also checks for uncovered HTTP methods