sorry, JBoss 4.0.1SP1 is required. Seems the internal security API changed from 4.0.1 to 4.0.1SP1. I have changed the online docs and reuploading preview 4 so that the dist documentation reflects this.
It works when I use jboss4.0.1sp1 and follow the installation instruction. Plus remove the jboss-aop.deployer from jboss4.0.1/server/all/deploy directory like the preview3 did.
I was using 4.0.1, I will try with 4.0.1 SP1