If the intention of the method is to verify and validate a user  you can return  a value with possible propagation of security context, otherwise if the intention is to control the secure access to a method and guarantee that the method is access by privileged user, you should throw an application exception. this is to comply with design strategies.

Refer to business-tier design strategies and best practices.