#65 - better handling of security header when no username token is provided