Microsoft Web Services Extension 3: Custom UsernameTokenManager does not throw error if password is missing in SOAP Request

Question

I am fairly familiar with how custom UsernameTokenManager works. It's all fine if a username & password is provided by the client in the SOAP request. If the client explicitly excludes the password (<wsse:Password> tag), I would expect the framework to throw a corresponding exception. Unfortunately the webservice call proceeds as usual. When debugging, I can see that my custom UsernameTokenManager is being invoked (method AuthenticateToken) and it returns the correct password; but something is not working after that. Any clues?