How can you specify different permissions for the remote and local interface. Reading http://docs.oracle.com/javaee/6/api/index.html?javax/ejb/Local.html suggest the PermitAll annotation can be either applied to the class or the method, however it does not mention being applied to the interface ?