security subsystem has a ModuleClassLoader locator that combines module cl + tccl for the JDK jaas setup.

Jason's comment:
The TCCL is set to the last module. But yeah the problem is that its set once for the whole login stack. I think to correct this picketbox needs to wrap every login module with a TCCL setup/restore wrapper.