protected boolean checkRights(int level, boolean move) throws IOException, CredentialException
    {
        // check if we are logged out
        // bug 18 says cookies are returned with + instead of _
        String username = URLEncoder.encode(user.getUsername(), "UTF-8").replace('_', '+');
        if (!cookies.containsValue(username))
        {
            logger.log(Level.SEVERE, "Cookies have expired");
            logout();
            throw new CredentialExpiredException("Cookies have expired.");
        }

        // admins can do anything, this also covers FULL_PROTECTION
        if (user.isA("sysop"))
            return true;
        switch (level)
        {
            case NO_PROTECTION:
                return true;
            case SEMI_PROTECTION:
                return user != null; // not logged in => can't edit
            case MOVE_PROTECTION:
            case SEMI_AND_MOVE_PROTECTION:
                return !move; // fall through is OK: the user cannot move a protected page
            // cases PROTECTED_DELETED_PAGE and FULL_PROTECTION are unnecessary
            default:
                return false;
        }
    }