JBoss

This version fixed a leak of the authenticated JAAS Subject
back to the Tomcat thread pool. The Subject associated with
the thread was not being cleared, but the the principal and
credentials were. Although this did not affect authentication or
authorization, it could cause a previously authenticated Subject
to be seen in an unauthenticated context. Applications
associating sensitive information with the Subject or basing
security decisions on the Subject via custom integration with
JBoss could have been affected by this leak.