I think extremely simple test deployments can use settings from the domain model. Something along the lines:
<security-domain><login-module name="inlinemodule"><option user="anil" pass="awesome"/> <option role="magic"/></login-module>
This is for testing purposes or demo purposes only.