Ok I have just verified the web to ejb call portion of this and that aspect is fixed - I am only seeing a single into the login module despite multiple calls to the web app and the secured ejb.
The issue I am now working on is the following: -
https://issues.jboss.org/browse/AS7-3525
This issue will be relevent if you regularly disconnect and reconnect to the AS instance as that will be the trigger for a re-authentication - if a connection is maintained you should still be able to make many calls to deployed EJBs without the re-authentication after the first call.