Uh, never mind about:
It's no longer looking for jbossws-users.properties - now it's looking for users.properties.
I had left out this:
@SecurityDomain(value = "JBossWS")
All right, onward and upward with my plan. Still wondering about the deployment descriptor stuff and if anyone can think of a reason why this shouldn't work?