@Override
	public void filter(ContainerRequestContext requestContext) throws IOException {
		User loggedUser = authResource.getLoggedUser(servletRequest.getSession().getId());

		Boolean rolesOnMethod = resourceInfo.getResourceMethod().isAnnotationPresent(RolesAllowed.class);
		Boolean permitAllOnMethod = resourceInfo.getResourceMethod().isAnnotationPresent(PermitAll.class);
		Boolean rolesOnClass = resourceInfo.getResourceClass().isAnnotationPresent(RolesAllowed.class);
		Boolean loginRequired = rolesOnMethod || (rolesOnClass && ! permitAllOnMethod);
		if (loginRequired && loggedUser == null) {
			requestContext.abortWith(
					Response.status(Response.Status.UNAUTHORIZED).entity("").build()
			);
		} else if (loginRequired) {
			String[] allowedRoles = rolesOnMethod ? resourceInfo.getResourceMethod().getAnnotation(RolesAllowed.class).value()
				: resourceInfo.getResourceClass().getAnnotation(RolesAllowed.class).value();
			if (! roleMatch(loggedUser.getRoles(), Arrays.asList(allowedRoles))) {
				requestContext.abortWith(
						Response.status(Response.Status.FORBIDDEN).entity("").build()
				);
			}
		} // else login is not required

		/* next line is prepared when SecurityContext goes through EJB container too
		and also when I mistakenly use annotation.security.RolesAllowed to deny access
		*/
		requestContext.setSecurityContext(new Authorizer(loggedUser));
	}