Finally I've got it all my way:
Two separate Linux RH8.0 machines, each running jboss 3.2.2 on jsdk 1.4.2_02 and Tomcat replaced by Jetty! No more WARNings except for the "Heartbeat"-thing! The one jboss-machine serves a presentation layer consisting of .jsp files. These transact with the other machine's EJB-beans communicating with the Hypersonic database. This works flaw-less-ly without any security problems! Mind you, jsdk141 on de bean-machine is NOT good enough to do this tric.
Next step will be to use a MySQL database in stead of Hypersonic.