<message negotiateServiceCredential="true" /> for security