de> with "*" must return false. If the role-name of the security-role to be tested is "**", and
 the application has NOT declared an application security-role with role-name "**", <code>isUserInRole</code> must
 only return true if the user has been authenticated; that is, only when <a href="../../../jakarta/servlet/http/HttpServletRequest.html#getRemoteUser--"><code>getRemoteUser()</code></a> and
 <a href="../../../jakarta/servlet/http/HttpServletRequest.html#getUserPrincipal--"><code>getUserPrincipal()</c