How does it return the owner's recoder?

Code:
dianne's Contacts
id Name Email 
4  Karen Sutherland  karen@sutherland.com  Del Admin Permission 
5  Mitchell Howard  mitchell@abcdef.com  
6  Rose Costas  rose@xyz.com  Del 
8  Cindy Smith  cindy@smith.com  


Add 

Logoff (also clears any remember-me cookie)
I try to trace it with codes, buy I didn't find how to do.


from login:
Code:
    <bean id="urlMapping" class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
        <property name="mappings">
            <props>
                <prop key="/hello.htm">publicIndexController</prop>
                <prop key="/secure/add.htm">secureAddForm</prop>
                <prop key="/secure/index.htm">secureIndexController</prop>
                <prop key="/secure/del.htm">secureDeleteController</prop>
                <prop key="/secure/adminPermission.htm">adminPermissionController</prop>
                <prop key="/secure/deletePermission.htm">deletePermissionController</prop>
                <prop key="/secure/addPermission.htm">addPermissionForm</prop>
			</props>
        </property>
    </bean>
Code:
    <bean id="secureIndexController" class="sample.contact.SecureIndexController">
    	<property name="contactManager"><ref bean="contactManager"/></property>
 	</bean>
Code:
    public ModelAndView handleRequest&#40;HttpServletRequest request, HttpServletResponse response&#41; throws ServletException, IOException &#123;
        List myContactsList = contactManager.getAll&#40;&#41;;
        Contact myContacts&#91;&#93;;
        if&#40;myContactsList.size&#40;&#41; == 0&#41;
            myContacts = null;
        else
            myContacts = &#40;Contact&#91;&#93;&#41;&#40;Contact&#91;&#93;&#41;myContactsList.toArray&#40;new Contact&#91;0&#93;&#41;;
        Map model = new HashMap&#40;&#41;;
        model.put&#40;"contacts", myContacts&#41;;
        return new ModelAndView&#40;"index", "model", model&#41;;
    &#125;
Code:
   <bean id="contactManager" class="org.springframework.aop.framework.ProxyFactoryBean">
      <property name="proxyInterfaces"><value>sample.contact.ContactManager</value></property>
      <property name="interceptorNames">
         <list>
            <idref local="transactionInterceptor"/>

            <idref bean="contactManagerSecurity"/>

<!--
I know that 's the bean "contactManagerSecurity " does.

because after I remove it , it shows all 9 recorders.
-->

            <idref local="contactManagerTarget"/>
         </list>
      </property>
   </bean>


Code:
  <bean id="contactManagerSecurity" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor">
      <property name="authenticationManager"><ref bean="authenticationManager"/></property>
      <property name="accessDecisionManager"><ref local="businessAccessDecisionManager"/></property>
      <property name="afterInvocationManager"><ref local="afterInvocationManager"/></property>
      <property name="objectDefinitionSource">
         <value>
				sample.contact.ContactManager.create=ROLE_USER
				sample.contact.ContactManager.getAllRecipients=ROLE_USER
				sample.contact.ContactManager.getAll=ROLE_USER,AFTER_ACL_COLLECTION_READ
				sample.contact.ContactManager.getById=ROLE_USER,AFTER_ACL_READ
				sample.contact.ContactManager.delete=ACL_CONTACT_DELETE
				sample.contact.ContactManager.deletePermission=ACL_CONTACT_ADMIN
				sample.contact.ContactManager.addPermission=ACL_CONTACT_ADMIN
         </value>
      </property>
I'm puzzled here. I don't know how it filtes the recorders?