Index: trunk/grails-app/conf/SecurityConfig.groovy
===================================================================
--- trunk/grails-app/conf/SecurityConfig.groovy	(revision 145)
+++ trunk/grails-app/conf/SecurityConfig.groovy	(revision 147)
@@ -3,5 +3,5 @@
     def authenticateService
 
-	// see DefaultSecurityConfig.groovy for all settable/overridable properties
+	// See DefaultSecurityConfig.groovy for all settable/overridable properties
 
 	active = true
@@ -14,23 +14,24 @@
 	authorityDomainClass = "Authority"
 
-    //Required if we want to run "grails generate-manager"
-    //Which recreates the controller and views, so save the views!
+    // Required if we want to run "grails generate-manager"
+    // Which recreates the controller and views, so save the views!
 //     requestMapClass = 'Requestmap'
 
+    // The whole application relies on controllerAnnotations and the static rules bellow.
     useRequestMapDomainClass = false
     useControllerAnnotations = true
 
-    //Set true especially if used across the internet.
+    // Set true especially if used across the internet.
     forceHttps = 'false'
 
-    //Pessimistic locking, deny access to all URLs that don't 
-    //have an applicable URL-Role configuration.
-    //This forces us to set an annotation, static rule or
-    //extend BaseController and prevents accidentally leaving pages open.
+    // Pessimistic locking, deny access to all URLs that don't 
+    // have an applicable URL-Role configuration.
+    // This forces us to set an annotation, static rule or
+    // extend BaseController and prevents accidentally leaving pages open.
     controllerAnnotationsRejectIfNoRule = true
-    
-    //Static rules for controllers, actions and urls.
-    //Since we are using pessimistic locking we have to set some things
-    //here but most security should be set in the controllers.
+
+    // Static rules for controllers, actions and urls.
+    // Since we are using pessimistic locking we have to set some things
+    // here but most security should be set in the controllers.
     controllerAnnotationStaticRules = [
     '/': ['IS_AUTHENTICATED_FULLY'],
@@ -39,14 +40,7 @@
     '/images/**': ['IS_AUTHENTICATED_ANONYMOUSLY'],
     '/js/**': ['IS_AUTHENTICATED_ANONYMOUSLY'],
-     '/plugins/**': ['IS_AUTHENTICATED_FULLY'],
-//     '/plugins/help-balloons-1.2/**': ['IS_AUTHENTICATED_FULLY'],
-//     '/plugins/richui-0.6/**': ['IS_AUTHENTICATED_FULLY'],
-//     '/plugins/navigation-1.1/**': ['IS_AUTHENTICATED_FULLY'],
-//     '/plugins/filterpane-0.6.2/**': ['IS_AUTHENTICATED_FULLY'],
-//     '/plugins/calendar-1.2.0-SNAPSHOT2/**': ['IS_AUTHENTICATED_FULLY'],
-//
-//     '/plugins/class-diagram-0.3/**': ['IS_AUTHENTICATED_FULLY'],
-//     '/classDiagram*': ['IS_AUTHENTICATED_FULLY'],
-//     '/classDiagram/**': ['IS_AUTHENTICATED_FULLY'],
+    '/plugins/**': ['IS_AUTHENTICATED_FULLY'],
+    '/classDiagram*': ['IS_AUTHENTICATED_FULLY'],
+    '/classDiagram/**': ['IS_AUTHENTICATED_FULLY'],
     '/login*': ['IS_AUTHENTICATED_ANONYMOUSLY'],
     '/login/**': ['IS_AUTHENTICATED_ANONYMOUSLY'],
@@ -55,12 +49,13 @@
     ]
 
-    //We always want to go to the home page so that bookmarks are not used.
+    // Always call the welcome action so that bookmarks are not used, a
+    // welcome message can be populated and the sessionTimeout can be set.
     defaultTargetUrl = '/appCore/welcome'
     alwaysUseDefaultTargetUrl = true
 
-    //User caching, turned this off so that password changes take effect.
-    //It would appear that user is still in the session as logout/login
+    // User caching, turned this off so that password changes take effect.
+    // It would appear that user is still in the session as logout/login
     // is still required for role changes to take effect.
-    //If this option causes high database load try:
+    // If this option causes high database load try:
     //  import org.acegisecurity.providers.dao.DaoAuthenticationProvider
     //  import org.acegisecurity.context.SecurityContextHolder
@@ -71,6 +66,6 @@
     cacheUsers = false
 
-//    //List for and events and run the closure(s) that follow.
-//    //Unfortunately the session is not available yet so many things can't be done here, us an defaultTargetUrl and controller.
+//    // Listen for events and run the closure(s) that follow.
+//    // Unfortunately the session is not available yet so many things can't be done here, use a defaultTargetUrl and controller.
 //    useSecurityEventListener = true
 //
