The security realm is not propagated to the (injected) 
EJB when the bean is created or at the time of injection or when referenced 
by the REST endpoint.  This appears to be missing functionality in the security
system