Security subsystem refactoring

This replaces https://github.com/jbossas/jboss-as/pull/3699 with just an additional commit to fix a test issue.