I am not sure what you are asking about creating different users. You could look at the documentation on secuirty at http://docs.jboss.org/jbossas/jboss4guide/r5/html/ch8.chapter.html
Regarding threads, JBoss uses Tomcat as the web server. Threads are not allocated for login. Instead, Tomcat provides a thread pool to handle incoming requests. There is a maximum thread pool size, and if a new requeust comes in and all the threads in the pool are busy, that new request is queued until a thread becomes free. See http://docs.jboss.org/jbossas/jboss4guide/r5/html/ch9.chapt.html, look for the term 'maxThreads'.
Thanks Peter, that did help.