Set binding security to <security mode="message">