o.c.sec: Add preference-based JAAS config

.. in addition to using ordinary JAAS config file