someone says that this is special rules or limits for J2EE's security because this can avoid getting user's info from the other .war of Hacker.

I can't be sure that it's true.

Maybe Jboss core developer can answer this simple question,that is but serious for me.