Looks like this check takes place in portal-impl.jar’s  com.liferay.portal.struts.PortalRequestProcessor.class. (Just thought you’d like to know). You never know when you may need to override this feature.

I really like this class in Liferay. This class is a ServiceBuilder generated class and is found in portal-service’s com.liferay.portal.service. It provides a lot of built-in routines to get user-specific data from the Liferay tables. You should really check this one out!

If you’re using Struts, consider using the Liferay StrutsPortlet controller (com.liferay.portlet.StrutsPortlet). It extends LiferayPortlet and provides some insulation against using the apache struts version directly.