p.s. with the flag="required" in auth-module, the example does not run on JBoss AS 7.1.1, which at the time of writing is the latest version one can download.
I wonder btw what the purpose of modules like org.jboss.as.web.security.jaspi.modules.HTTPBasicServerAuthModule is. Are they present in the source for example purposes? Why aren't JASPI modules the default, if those are indeed the future of authentication modules in Java EE?