I'm going to have a crack at answering my own question as I go along.
Here's how I got through it
The following xml files used to have doctypes, but must now have namespaces:
myApp.ear/META-INF/application.xml
<application version="5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/application_5.xsd">
myApp.ear/web.war/WEB-INF/web.xml
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
myApp.ear/ejb.jar/META-INF/ejb-jar.xml
<ejb-jar id="ejb-jar_ID" version="3.0"
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd">
The following changes have been made to web.xml
Remove myApp.ear/ejb.jar/META-INF/ibm-ejb-jar-bnd.xmi
JNDI lookups
change all your local ejb jndi lookups to use ejblocal:[classname]
I also removed my jdbc resource ref from ejb-jar.xml mappings and am using a global lookup instead
The security problem I was having was because I removed ibm-application-bnd.xmi where it binds users and groups to roles/