Use the class name instead of the class directly as cxf-rt-ws-addr SHOULD be optional and using the class prevents that.
At least log a FINE message about why the sec-policy stuff failed to load.