The problem is that the merge operation does implicitly handle both cases! So using the merge operation doesn't mean always modify.
BTW, I prefer a declarative authorization.
[Message sent by forum member 'mohammadwrk' (mohammadwrk)]
http://forums.java.net/jive/thread.jspa?messageID=228086