@Test(expectedExceptions = { SecurityException.class })

public void accessDeniedViaOrigin() {
    expect(backend.isRemoteAccessAllowed("localhost","127.0.0.1")).andReturn(true);
    expect(backend.isOriginAllowed("www.jolokia.org",true)).andReturn(false);
    replay(backend);
    handler.checkAccess("localhost", "127.0.0.1","www.jolokia.org");
}