Upgrading to EAP 6.2 and higher makes WS-Security fail due to no auth

Issue

• We have a webservice which uses WS-Security to authenticate users. The webservice works in JBoss EAP 6.0.1, but after upgrading to 6.2.2 the webservice fails. The webservice receives the message okay, but when it calls a bean annotated with @RolesAllowed, it fails saying the user has is invalid (JBAS013323: Invalid User).
• We have a JAX-WS handler that we want to execute on all requests, regardless of whether or not the client is authorized to invoke the requested operation.
• I'm getting error JBWS024094: Authorization failed, principal=<name>.