Java EE Security alignment

In JavaEE 7 we have some security problems with WebSocket.

An authenticated session, with a valid Session.getUserPrincipal()
doesn't authenticates in the container on websocket events, so EJB / CDI calls are unauthenticated.

I've tested with WildFly 8.2.0 and GlassFish 4.1, with a sample app
which calls EJB methods from @onOpen, @onClose and @onMessage.

Although we can workaround these issues with interceptors and vendor
specific security managers, it's a common use case for JavaEE applications and an important requirement for cloud/SaaS applications.

I've created an open-source library to get workaround these problems in
JBoss/WildFly. It's called "JBoss Security Extended" and is available on maven central with GAV "com.github.panga:jboss-security-extended:1.0.0".

Library source and docs:
[https://github.com/panga/jboss-security-extended](https://github.com/panga/jboss-security-extended)
WebSocket sample app source using library:
[https://github.com/panga/websocket-auth](https://github.com/panga/websocket-auth)

Start by reproducing the WebSocket authentication behavior with the referenced websocket-auth sample on WildFly 8.2.0 and GlassFish 4.1, then review the jboss-security-extended workaround and its documentation. The issue does not define a target implementation or acceptance test, so completion requires an agreed Java EE security-alignment scope and verification that EJB/CDI calls from @onOpen, @onClose, and @onMessage are authenticated.

Written by the indexing model from the issue text.