Actually because you are working on a web  app, you have to have a secure connection. You need to protect the data that is transferred over the air or wire against malicious manipulation and unauthorized access. The user needs to prove that s/he is the one s/he is claiming to be. You need data encryption for sure, it is very risky and insecure to only define rules and access privileges for your server resources. How do you know if the data is stolen on the way to server?

Here is an example of a secure web service access, it might not be %100 what you want, only read it from the secure web access perspective
java.sun.com/.../index.html
java.sun.com/.../appserv8-1.html

Do not mix up EJB security  with Web Application Security. As a reference, refere to Security chapter, Part 3 Mastering EJB 3

www.theserverside.com/.../index.tss