title: Spring - How to protect RESTful private resources?
body: <p>I've some RESTful services, implemented with Spring MVC, exposing a set of resources. I already use authentication, based on HTTPBasicAuthentication and HTTPS. Some of the resources must be accessible only to some users.</p>
  
  <p>For example, I want that all sub-resources in the URI <code>/users/{userid}/photos</code> are accessible only to the user <code>userid</code>. Actually in my application they are accessible to all authenticated users. How can I protect them from other users except <code>userid</code>?
  And what if I want to allow access to this resources only to a subset of users (like, for example, <code>userid</code>'s friends)?</p>