I understand the use-case, but it should be handled by a security domain which always gives the correct password.
You can find the security domain types for AS 7 here - https://community.jboss.org/wiki/JBossAS7SecurityDomainModel - or write a custom one - https://community.jboss.org/wiki/JBossAS7SecurityCustomLoginModules.
That functionality is also available for JBoss 5.1 - check with the PicketBox people for that.