FYI, here's the solution to the mind numbing problem that I was having.
It turns out that the <security-domain> in jboss.xml and jboss-web.xml is space sensitive. Any leading or trailing spaces between the angle brackets get included in the domain name. It will fail to match a domain in the auth.conf file, but what's worse is nowhere does it report what string it's looking for or what failed aside from a rather cryptic "not bound" message.
Carefull with those spaces campers!