Best practice: Extend RequestProcessor and perform authentication
in methods such as processActionPerform() or processRoles().

– http://www.javaworld.com/javaworld/jw-09-2004/jw-0913-struts-p2.html