Based on notes - this appears to be an issue when security policy is None, but in the security group there are discussion about if for security policy none anything but Anonymous should be allow. I think before we fix this issue we should first sort out what is actually allowed for security Policy None

When the security working decides on a specific limits for the UserTokens when using SecurityPolicy None we really should be adding specific testing to test for those requirements. With those special tests for the requirements there wouldn't be a need to delay this change until the is decided. I would suggest to resolve the mantis and allow the CTT to handle the current situation.