A WAR file with a secure servlet but without a security-domain defined in jboss-web.xml, defaults to 'other'. When that WAR file is deployed within a EAR that has a security-domain defined in jboss-app.xml, it is ignored and 'other' is used instead.