Why did Spring Security messages go missing in Grails production app on Tomcat 7?

I've deployed my grails app to Tomcat, and the only thing that broke is the spring-security-core messages in the login form. For example, the code

<g:message code="s开发者_高级运维pringSecurity.login.username.label" />

now produces the output

springSecurity.login.username.label

What could have gone wrong?