ignoring client WS-Security headers on the server

[Jeff Greif]

I have a web service which (at the moment) does not care about 
security.  The client, however, insists on using WS-Security to sign its 
messages, which presumably puts mustUnderstand=1 somewhere in a SOAP 
header.  Is there some way for the server to process the message without 
producing a could-not-understand fault, by using either a WS-Security 
handler with a loose policy or even better, a trivial handler or no 
handler at all?  In what part of the processing is the decision about 
mustUnderstand made?

Jeff