if availablePoliciesStr == "" {
			// all policies presented in the claim should exist
			iamLogIf(GlobalContext, fmt.Errorf("expected policy (%s) missing from the JWT claim %s, rejecting the request", policies, iamPolicyClaimNameOpenID()))

			return false
		}
		combinedPolicy = c
	}

	// 3. If an inline session-policy is present, evaluate it.

	// Now check if we have a sessionPolicy.

  // path is matched against the path of an incoming request. Currently it can
  // contain characters disallowed from the conventional "path" part of a URL
  // as defined by RFC 3986. Paths must begin with a '/' and must be present
  // when using PathType with value "Exact" or "Prefix".
  // +optional
  optional string path = 1;

  // pathType determines the interpretation of the path matching. PathType can
  // be one of the following values:

		if e := recover(); e != nil {
			msg := fmt.Sprintf("istio-cni panicked during cmdAdd: %v\n%v", e, string(debug.Stack()))
			if err != nil {
				// If we're recovering and there was also an error, then we need to
				// present both.
				msg = fmt.Sprintf("%s: %v", msg, err)
			}
			err = errors.New(msg)
		}
		if err != nil {
			log.Errorf("istio-cni cmdAdd error: %v", err)
		}
	}()

			Description:    "An Object Lock configuration is present on this bucket, versioning cannot be suspended.",
			HTTPStatusCode: http.StatusBadRequest,
		}, r.URL)
		return
	}
	if rc, _ := getReplicationConfig(ctx, bucket); rc != nil && v.Suspended() {
		writeErrorResponse(ctx, w, APIError{
			Code:           "InvalidBucketState",
			Description:    "A replication configuration is present on this bucket, bucket wide versioning cannot be suspended.",

  // `verbs` is a list of matching verbs and may not be empty.
  // "*" matches all verbs and, if present, must be the only entry.
  // +listType=set
  // Required.
  repeated string verbs = 1;

  // `apiGroups` is a list of matching API groups and may not be empty.
  // "*" matches all API groups and, if present, must be the only entry.
  // +listType=set
  // Required.
  repeated string apiGroups = 2;

 * enriched {@link Iterable} for pre-Java-8 users.
 *
 * <h3>Three types of methods</h3>
 *
 * Like other fluent types, there are three types of methods present: methods for <i>acquiring</i>,
 * <i>chaining</i>, and <i>using</i>.
 *
 * <h4>Acquiring</h4>
 *
 * <p>The common ways to get an instance of {@code Ordering} are:
 *
 * <ul>

 *
 * <h2>More on {@code CacheBuilder}</h2>
 *
 * {@code CacheBuilder} builds caches with any combination of the following features:
 *
 * <ul>
 *   <li>automatic loading of entries into the cache
 *   <li>least-recently-used eviction when a maximum size is exceeded (note that the cache is
 *       divided into segments, each of which does LRU internally)
 *   <li>time-based expiration of entries, measured since last access or last write

  /** Return type from "contains the following elements" assertions. */
  public interface Ordered {
    /**
     * Attests that the expected values must not just be present but must be present in the order
     * they were given.
     */
    void inOrder();
  }

  @IgnoreJRERequirement // *should* be redundant with the annotation on SpliteratorTester

  /** Return type from "contains the following elements" assertions. */
  public interface Ordered {
    /**
     * Attests that the expected values must not just be present but must be present in the order
     * they were given.
     */
    void inOrder();
  }

  private abstract static class GeneralSpliterator<E extends @Nullable Object> {
    final Spliterator<E> spliterator;

    assertThat(buildIfSupported()).isNotNull()
  }

  @Test
  fun buildsWhenJdk8() {
    platform.assumeJdk8()
    try {
      SSLSocket::class.java.getMethod("getApplicationProtocol")
      // also present on JDK8 after build 252.
      assertThat(buildIfSupported()).isNotNull()
    } catch (nsme: NoSuchMethodException) {
      assertThat(buildIfSupported()).isNull()
    }
  }

  @Test