同时加上allow的用户
    <authorization>
        <deny users="?" />
        <allow users="user"/>
    </authorization>