Is is true that you have to setup Alfresco CMIS web services to use SSL to allow them to be called from WCF? From what I've been reading it appears that WCF only allows WS-Security Username token when you use SSL as otherwise the password will be sent in clear text and this is a secruity risk.