Sun is pushing out the final release of J2EE 1.4 to this summer, so they can incorporate any webservice security features that may be about to be proposed by the WS-I group.
The Proposed Final Draft 2 J2EE 1.4 spec has been available on the Java site since November 2002.