code: public static void doAuthorization(UserSession session,String uri) throws UnauthorizedException,ForbiddenAccessException{
  		boolean isSuperAdmin = getInstance().decisionProvider.superAdminName().equals(session.getUserName());
  		if(!isSuperAdmin && !getInstance().resourceManager.isAnonymous(uri)){
  			if(session == null || session.isAnonymous()){
  				throw new UnauthorizedException();
  			}
  			String permssionCode = getInstance().resourceManager.getPermssionCode(uri);
  			if(StringUtils.isNotBlank(permssionCode) 
  					&& !getInstance().resourceManager.getUserPermissionCodes(session.getUserId()).contains(permssionCode)){
  				throw new ForbiddenAccessException();
  			}
  		}
  		//
  		if(session != null && !session.isAnonymous()){			
  			getInstance().decisionProvider.authorizedPostHandle(session);
  		}
  	}
docs: 鉴权
  @param userId
  @param uri