The config files changes for AS 7 and web are:
- Server.xml is gone, all server configuration moves to the domain model
- Per webapp context.xml is gone, any useful configuration should be added to the jboss-web.xml config file (so the realm settings should go there); parsing and handling of that file is done in metadata (from jfclere repository)
+1 for minimizing access checks, per request logins, associations of security contexts, etc, whenever possible ;)