@Override
    public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws IOException {
        String[] perms = (String[]) mappedValue;
        // append the http action to the end of the permissions and then back to super
        String action = getHttpMethodAction(request);
        String[] resolvedPerms = buildPermissions(perms, action);
        return super.isAccessAllowed(request, response, resolvedPerms);
    }
Resolves an 'application friendly' action verb based on the {@code HttpServletRequest}'s method, appends that
action to each configured permission (the {@code mappedValue} argument is a {@code String[]} array), and
delegates the permission check for the newly constructed permission(s) to the superclass
{@link PermissionsAuthorizationFilter#isAccessAllowed(ServletRequest, ServletResponse, Object) isAccessAllowed}
implementation to perform the actual permission check.

@param request     the inbound {@code ServletRequest}
@param response    the outbound {@code ServletResponse}
@param mappedValue the filter-specific config value mapped to this filter in the URL rules mappings.
@return {@code true} if the request should proceed through the filter normally, {@code false} if the
request should be processed by this filter's
{@link #onAccessDenied(ServletRequest, ServletResponse, Object)} method instead.
@throws IOException
web/src/main/java/org/apache/shiro/web/filter/authz/HttpMethodPermissionFilter.java