In other areas of the authentication configuration where the ClassLoader is used we allow an optional module to be specified, we don't do this for <keyStore><resource/><keyStore> which only accepts a name.