//check are we allowed to show the xquery source - descriptor.xml
// System.out.println("path="+path);
if(descriptor.allowSource(path)) {
try {
source.validate(user, Permission.READ);
} catch (final PermissionDeniedException e) {
if (getDefaultUser().equals(user)) {
getAuthenticator().sendChallenge(request, response);
} else {
response.sendError(HttpServletResponse.SC_FORBIDDEN, "Permission to view XQuery source for: " + path + " denied. (no read access)");