public boolean isAllowed(HttpServletRequest httpRequest, HttpServletResponse httpResponse)
			throws IOException {
		if (!isRequestAllowed(httpRequest)) {
			LOG.debug("Forbidden access to monitoring from " + httpRequest.getRemoteAddr());
			httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "Forbidden access");
			return false;
		}
		if (!isUserAuthorized(httpRequest)) {
			// Not allowed, so report he's unauthorized
			httpResponse.setHeader("WWW-Authenticate", "BASIC realm=\"JavaMelody\"");
			if (isLocked()) {
				httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED,
						"Unauthorized (locked)");
			} else {
				httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
			}
			return false;
		}
		return true;
	}
@Test
	public void testIsAllowed() throws IOException {
		assertTrue("no auth", isAllowed());
		setProperty(Parameter.ALLOWED_ADDR_PATTERN, REMOTE_ADDR);
		assertTrue("addr pattern", isAllowed());
		setProperty(Parameter.ALLOWED_ADDR_PATTERN, "none");
		assertFalse("addr pattern", isAllowed());
		setProperty(Parameter.ALLOWED_ADDR_PATTERN, null);
		setProperty(Parameter.AUTHORIZED_USERS, USER_PWD);
		assertFalse("authorized users", isAllowed(null));
		assertFalse("authorized users", isAllowed("not BASIC"));
		assertTrue("authorized users", isAllowed("BASIC " + Base64Coder.encodeString(USER_PWD)));
		setProperty(Parameter.AUTHORIZED_USERS, "none");
		assertFalse("authorized users", isAllowed("BASIC " + Base64Coder.encodeString(USER_PWD)));

		// check lock
		final HttpAuth httpAuth = new HttpAuth();
		setProperty(Parameter.AUTHORIZED_USERS, USER_PWD);
		// 20 > HttpAuth.AUTH_FAILURES_MAX
		for (int i = 0; i < 20; i++) {
			assertFalse("lock",
					isAllowed(httpAuth, "BASIC " + Base64Coder.encodeString("notuser:notpwd")));
		}
		assertFalse("lock", isAllowed(httpAuth, "BASIC " + Base64Coder.encodeString(USER_PWD)));
	}