public View match(ActionContext ac) {
		if (yvrService == null)
			yvrService = ac.getIoc().get(YvrService.class);
		HttpServletRequest req = ac.getRequest();
		String at = req.getParameter("accesstoken");<--------1
		if (req.getHeader("Api-Version") != null) {
			log.debug("api version = " + req.getHeader("Api-Version"));
			String loginname = req.getHeader("Api-Loginname");
			String nonce = req.getHeader("Api-Nonce");
			String key = req.getHeader("Api-Key");
			String time = req.getHeader("Api-Time");
			if (Strings.isBlank(loginname) || Strings.isBlank(nonce) || Strings.isBlank(key) || Strings.isBlank(time)) {
				return BaseModule.HTTP_403;
			}
			if (!yvrService.checkNonce(nonce, time)){
				return BaseModule.HTTP_403;
			}
			at = yvrService.accessToken(loginname);<--------2
			if (Strings.isBlank(at)) {
				return BaseModule.HTTP_403;
			}
			String tmp = Strings.join(",", at, loginname, nonce, time);
			String _key = Lang.sha1(tmp);
			log.debug("tmp="+tmp);
			log.debug("_key=" + _key);
			log.debug(" key=" + key);
			if (!_key.equals(key)) {
				return BaseModule.HTTP_403;
			}
			log.debug("api access token check ok");
		} 
		else if (Strings.isBlank(at)) { // TODO 移除这种兼容性,改成必须用nonce加密
			return BaseModule.HTTP_403;
		}
		int uid = yvrService.getUserByAccessToken(at);
		if (uid < 1) {
			return BaseModule.HTTP_403;
		}
		SecurityUtils.getSubject().getSession().setAttribute("me", uid);
		return null;
	}

在1处得到的accesstoken没有判断是否合法就赋值覆盖了？不是很懂这块的流程逻辑。