SecurityException not being thrown?

SourceForge Submitter: topping .
Environment:

Client is W2K SP3, JDK 1.4.1_01, client libs copied
from server.

Server is SuSE 8.1, JDK 1.4.1_01, JBoss 3.2.0B3.

Deploying a client on the same VM as the server works
properly, splitting them across the network does not.
I'm used to seeing a SecurityException thrown when the
client is not logged in and tries to access a protected
resource, it does not seem to throw on 3.2B3. Instead, I
get a MarshalException or UnmarshalException
(changes between them over successive runs) with an
underlying SocketException.

I figured this out from looking at the network packet
traces, it looks like it is pushing the exception over the
wire, but the client is out of sync or otherwise treating
the exception data as the object data, which is then
throwing the UnmarshalException because the stream
is mismatched. I can provide whatever additional
information is necessary on this.

Many thanks, as always...