Its for both the application master and then for any worker containers launched and it works for both.  Based on what we talked about I will just remove these and the --user option.  The job will run as the user that launched it.  There shouldn't be an issues with oozie launching the job on either secure or insecure cluster either as oozie uses the hadoop proxy user setup.   I'll try to get an oozie setup and try to test that too.