"IllegalStateException: Security Context has not been set" when using ClientLoginModule

Issue

I am manually invoking authentication in my application (details below), and I'm getting this error:

2013-06-10 02:12:07,109 ERROR [org.jboss.web.tomcat.security.JBossWebRealm] (ajp-192.168.127.40-8209-3) Error during authenticate
java.lang.IllegalStateException: Security Context has not been set
    at org.jboss.web.tomcat.security.SecurityAssociationActions$SetPrincipalInfoAction.run(SecurityAssociationActions.java:71)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.jboss.web.tomcat.security.SecurityAssociationActions.setPrincipalInfo(SecurityAssociationActions.java:271)
    at org.jboss.web.tomcat.security.JBossWebRealm.authenticate(JBossWebRealm.java:403)
    at org.jboss.web.tomcat.security.login.WebAuthentication.login(WebAuthentication.java:93)

The code I use to invoke:

import org.jboss.web.tomcat.security.login.WebAuthentication;

pwl = new WebAuthentication();
boolean result = pwl.login(username, password);

Here's the configured security domain used:

<application-policy name="MySecurityDomain">
  <authentication>
    <login-module code="com.redhat.gss.example.SomeLoginModule" flag="required"/>
    <login-module code="org.jboss.security.ClientLoginModule" flag="required"/>
  </authentication>
</application-policy>