DataBinder setAllowedFields not working

[honeybunny]

I can't figure out why attempts to restrict the set of allowed fields which get bound in the controller is not working:

I have a base controller class which my controllers extend.

public abstract class AbstractMultiActionController extends MultiActionController {
	protected abstract String [] getAllowedFieldsForBind(HttpServletRequest request);

	protected void initBinder(HttpServletRequest request, ServletRequestDataBinder binder) throws Exception {
		String strings[] = getAllowedFieldsForBind(request);
		s_logger.debug("set allowed fields: " + strings);
		binder.setAllowedFields(strings);
	}

I see initBinder() being called, however; I don't see the affect, and I don't see any of the trace I would expect from DataBinder.setAllowedFields().

[honeybunny]

The problem is that setAllowedFields(new String[] {}) is the SAME AS allowing all fields. The javadoc should really be clearer here.