For HTTP header authentication, either WS_SSL_TRANSPORT_SECURITY_BINDING must also be included in the security description ...

For HTTP header authentication, either WS_SSL_TRANSPORT_SECURITY_BINDING must also be included in the security description for transport protection (preferred), or the security description property WS_SECURITY_PROPERTY_TRANSPORT_PROTECTION_LEVEL must be explicitly set to WS_PROTECTION_LEVEL_NONE (not recommended).