@POST
  @Path("{type:user|group}/{userid}")
  public Response doUpdateAuthorizable(
      @Context HttpServletRequest request,
      @Context HttpServletResponse response,
      @PathParam(value = "type") String authorizableType,
      @PathParam(value = "userid") String authorizableId) {
    try {
      AuthorizableManager authorizableManager = getAuthorizableManager(request, response);
      Authorizable authorizable = authorizableManager.findAuthorizable(authorizableId);
      Response checkType = checkType(authorizable, authorizableType);
      if (checkType != null) {
        return checkType;
      }

      // process the post request.
      AuthorizableHelper authorizableHelper = new AuthorizableHelper(authorizableManager);
      ModificationRequest modificationRequest = new ModificationRequest();
      modificationRequest.processRequest(request);
      authorizableHelper.applyProperties(authorizable, modificationRequest);
      authorizableHelper.save();
      final List<String> feedback = modificationRequest.getFeedback();

      return Response.ok(
              new StreamingOutput() {
                @Override
                public void write(OutputStream output) throws IOException, WebApplicationException {
                  ResponseUtils.writeFeedback(feedback, output);
                }
              })
          .type(MediaType.APPLICATION_JSON_TYPE.toString() + "; charset=utf-8")
          .lastModified(new Date())
          .build();

    } catch (StorageClientException e) {
      return ResponseUtils.getResponse(
          HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
    } catch (AccessDeniedException e) {
      return ResponseUtils.getResponse(HttpServletResponse.SC_FORBIDDEN, e.getMessage());
    } catch (IOException e) {
      return ResponseUtils.getResponse(
          HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
    } catch (FileUploadException e) {
      return ResponseUtils.getResponse(
          HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
    }
  }
  @GET
  @Path("{type:user|group}/{userid}.{format}")
  public Response getUser(
      @Context HttpServletRequest request,
      @Context HttpServletResponse response,
      @PathParam(value = "type") String authorizableType,
      @PathParam(value = "userid") String authorizableId,
      @PathParam(value = "format") final String outputFormat) {
    try {

      AuthorizableManager authorizableManager = getAuthorizableManager(request, response);
      final Authorizable authorizable = authorizableManager.findAuthorizable(authorizableId);
      Response checkType = checkType(authorizable, authorizableType);
      if (checkType != null) {
        return checkType;
      }
      Date lastModified = new Date();
      Long lm = (Long) authorizable.getProperty(Authorizable.LASTMODIFIED_FIELD);
      if (lm == null) {
        lm = (Long) authorizable.getProperty(Authorizable.CREATED_FIELD);
      }
      if (lm != null) {
        lastModified = new Date(lm);
      }
      return Response.ok(
              new StreamingOutput() {
                @Override
                public void write(OutputStream output) throws IOException, WebApplicationException {
                  ResponseUtils.writeTree(authorizable, outputFormat, output);
                }
              })
          .type(MediaType.APPLICATION_JSON_TYPE.toString() + "; charset=utf-8")
          .lastModified(lastModified)
          .build();

    } catch (StorageClientException e) {
      return ResponseUtils.getResponse(
          HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e.getMessage());
    } catch (AccessDeniedException e) {
      return ResponseUtils.getResponse(HttpServletResponse.SC_FORBIDDEN, e.getMessage());
    }
  }