After Debugging it seems to be that following static initialization will never be called:
in class Authorization
protected static Authorizer authorizer = (Authorizer) JbpmConfiguration.getObject("jbpm.authorizer", null);
maybe it seems to be a problem from 1.5. runtimes which i tested with jbpm-3.0.1.jar which is compiled against 1.5...
so i will recompile against 1.4 and test it again, will post results tomorrow