The JAAS based security interests me.
However I'm not a JAAS expert, so I hope you're patient...!
On behalf of Tom:
please post these on the dev forum. splitting the webapp won't be
necessary. we will first do the project restructuring in one of the
coming weeks (see other dev forum posts).