Optional inbound WSSec Username token header

if configured to allow this