lib/Endpoint.js
function(method, user, req) {
    var acl = this._cachedFullEndpointAcl
    if (acl === undefined) {
      acl = this._computeFullEndpointAcl()
      this._cachedFullEndpointAcl = acl
    }

    if (!acl) { // if no ACL we authorize
      return true
    }

    return acl.hasPermission(user, method, { req: req, endpoint: this })
  }
function(method, user, req) {
    var acl = this._cachedFullEndpointAcl
    if (acl === undefined) {
      acl = this._computeFullEndpointAcl()
      this._cachedFullEndpointAcl = acl
    }

    if (!acl) { // if no ACL we authorize
      return true
    }

    return acl.hasPermission(user, method, { req: req, endpoint: this })
  }
***************************************************************************
@method isOperationAuthorized
@description Tests whether an operation is authorized given a user (as
returned by the root authenticator) and any {@link
carbond.security.Acl} that may apply to this endpoint

@param {string} method -- The HTTP method corresponding to the operation
that we are attempting to authorize
@param {Object} user -- The user object
@param {carbond.Request} req -- The request object
@returns {boolean} -- Whether of not the operation is authorized