Using the felix console to monitor which module get loaded for the web application deployment, noticed the ejb container module got active and the ejb security module got resolved
208|Active | 1|org.glassfish.ejb.ejb-container (3.1.1.SNAPSHOT)
94|Resolved | 1|org.glassfish.security.ejb.security (3.1.1.SNAPSHOT)
we need to figure out which dependency had triggered the ejb related modules get loaded/resolved, they should not be for a pure web application. I will attach the test web application in the issue next.