@Test
public void denysAccessWhenUserDoesNotHaveAcceptableRole() {

    when(resourceMethod.getAnnotations()).thenReturn(new Annotation[] {rolesAllowed});
    when(securityContext.isUserInRole("user")).thenReturn(false);
    thrown.expect(webApplicationExceptionForbiddenMatcher());
    securityConstraint.accept(resourceMethod, null);
}