re-enable ws security (header check)