Validating WS-Security responses