Currently the only reliable way to clean ROLE headers is logout. In standalone this can be achieved by using "no preselection" option in "Run as" dialog, however this doesn't work in domain mode.
This behavior is confusing for customer and has to be properly document unless we managed to fix this until GA is released.
Modified Doc Text content and marked for inclusion in the 6.2 Release Notes document.
Moving to 6.4 as the issue is still valid for 6.3
Verified for EAP 6.4.0.ER1