WSS questions

["iwasa" <kiwasa@jp.fujitsu.com>]

Here are some questions I got from
users implementing ebMS3.0 CD.
I appreciate if someone can answer
the followings:

1) 6.2.1.1 Username / Password Option
   The example is including both <wsse:UsernameToken>
   and <SecurityTokenReference>.
--
<wsse:Security xmlns:wsse="…" xmlns:wsu="…"> 
  <wsse:UsernameToken wsu:Id="#TokenID"> 
     <wsse:Username>hamid</wsse:Username> 
     <wsse:Password>SomePassword</wsse:Password> 
  </wsse:UsernameToken> 
</wsse:Security> 
<eb:Messaging eb:version="3.0" SOAP:mustUnderstand="1" > 
  <eb:SignalMessage> 
     <wsse:SecurityTokenReference> 
        <wsse:Reference URI="#TokenID" /> 
     </wsse:SecurityTokenReference> 
     <eb:MessageInfo> …. </eb:MessageInfo> 
     <eb:PullRequest eb:forMbox="…" /> 
  </eb: SignalMessage>
</eb:Messaging>
--

   Can we omit <SecurityTokenReference> with
   this example, even if we use ID and Password? 
   Or is it mandatory to include the element?
   It seems redundancy.
   *If both of them should be included, the spec
   should mention it. If not, it should be mentioned 
   also.

2) The above example is for SignalMessage.
   How about for UserMessage? I assume the
   answer is the same with the above.

Thanks,

Iwasa