WSE: UserNameTokenManaer not invoked when client doesn't pass userNameToken

[nsyforce]

How come the authenticateToken method does not get invoked when a
client calling the web service does not attach a userNameToken to the
header? This seems like a security flaw. Is there something you need
to do to the web service for the authenticate method to be invoked
under such a scenario? Is there a KB article that I have not been
able to find?

For the example I have, if a caller of the web service attaches a
usernameToken, the authenticateToken method on my userNameTokenManager
gets invoked. IF they don't attach it to the header, they call the
function on the web service successfully as the userNameTokenManager
is never invoked.

(I am using WSE 2.0 SP3)

Thank you in advance.