JAX-WS in EAP 6: Irregular occurrences of JBAS013323: Invalid User

Issue

We have an application with Webservices. When running with some parallel load we sometimes get the error: JBAS013323: Invalid User. In our test case we always use the same user which authenticates using UsernameToken. The webservice is implemented as an EJB. As it looks from the stacktrace, the failing call doesn't reach our EJB. As the error only occurs now and then (sometimes it works for 10 minutes) it looks like a race condition for me.

Stack trace:

Caused by: javax.ejb.EJBAccessException: JBAS013323: Invalid User
    at org.jboss.as.ejb3.security.SecurityContextInterceptor$1.run(SecurityContextInterceptor.java:57) 
    at org.jboss.as.ejb3.security.SecurityContextInterceptor$1.run(SecurityContextInterceptor.java:48) 
    at org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:83) 
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) 
    at org.jboss.as.ejb3.component.interceptors.ShutDownInterceptorFactory$1.processInvocation(ShutDownInterceptorFactory.java:64) 
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) 
    at org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59) 
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) 
    at org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50) 
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) 
    at org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:55) 
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) 
    at org.jboss.as.ee.component.TCCLInterceptor.processInvocation(TCCLInterceptor.java:45) 
    at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) 
    at org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61) 
    at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:185) 
    at org.jboss.as.webservices.invocation.AbstractInvocationHandler.invoke(AbstractInvocationHandler.java:129)
    at org.jboss.wsf.stack.cxf.JBossWSInvoker.performInvocation(JBossWSInvoker.java:149)
    at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:104) 
    ... 34 more