Bump.
If anyone is interested, please take a look at the pack.tgz file I've attached, it contains eclipse 3.4.1 projects with the code in question. The only change I've made is that I explicitly mapped principal-names to role-names, so that the "Default principal to role mapping" doesn't need to be checked. It didn't change the behavior.
Cheers.
[Message sent by forum member 'szczyp' (szczyp)]
http://forums.java.net/jive/thread.jspa?messageID=316897