According to the servlet 2.4 spec, the run-as should be used for Servlet.init()
page 285:
" Clarification: run-as identity must apply to all calls from a servlet including init() and destroy() (12.7)"

This isn't working.

In JBoss 5.x, it looks like this functionality was implemented by a RunAsListener. However, that listener does not appear to exist in the EAP 6 code base.