Which two statements&#8194

Which two statements are true about using the isUserInRole method to implement security in a Java EEapplication？（）

• AIt can be invoked only from the doGet or doPost methods.
• BIt can be used independently of the getRemoteUser method.
• CCan return "true" even when its argument is NOT defined as a valid role name in the deployment descriptor.
• DUsing the isUserInRole method overrides any declarative authentication related to the method in which it is invoked.