Thank you for the quick reply...
I'm heavily interested in the possibillity to configure the allRolesMode since we've got multiple applications that are affected and our role names are'nt static. Our role names contain a version suffix since multiple versions of an application may be in production at the same time and the roles assigned to a user may differ for each version. Assigning a "strict" role would require us to change the role with each release which seems a repetitive and error-prone task for multiple applications.
Should i create a feature request in Jira or could you contact the JBoss Web team directly?