Explicitly adding the dependency to spring-ws-core version 4.0.12 solves the issue:

<dependency>
    <groupId>org.springframework.ws</groupId>
    <artifactId>spring-ws-security</artifactId>
    <version>4.1.0</version>
    <scope>compile</scope>
</dependency>

Might really be a bug in spring-ws-core 4.0.13+.