two web apps in the same JBoss instance. Using different JAAS domains set up in jboss-web.xml

login to first web app with user 'sa', correctly give roles R and X from the JAAS module
login to second web app with user 'sa', correctly gives roles R and Y from separate JAAS module

refresh listing page on first web app, user 'sa' now has roles from user 'sa' in web app2

this does happen in 4.0.3 SP1
this does NOT happen in 3.2.7