Expiring Stateful SessionBeans from servlet container

When a users session expires in the Servlet container (Tomcat) we want to remove the session's handles to stateful session beans in the EJB container (Jboss). To achieve this we have implemented a HttpSessionListener which does the following:

public void sessionDestroyed(HttpSessionEvent ev) {

  HttpSession session = ev.getSession();

  Handle ejbHandle = (Handle) session.getAttribute("ejbHandle");

  EjbHome ejbHome = (EjbHome) lookupHome

("EjbHome",EjbHome.class);

  ejbHome.remove(ejbHandle); // It fails here

}

When the session expires we get the following error in the server.log:
2005-09-28 15:12:03,386 ERROR [org.jboss.ejb.plugins.SecurityInterceptor] Authentication exception, principal=null. It seems like we don't have permission to call the remove method in the bean. We have configured security for all beans in the ejb-jar.xml using the statements.
We suspect that the sessionDestroyed method is called from a thread
which is not associated with a user, i.e. not authorized to run any
methods in the EJB-layer.
Any suggestions for how to implement expiration of Stateful session
beans from the web-layer?