使用用户名密码验证和会话的WCF服务

我有一个WCF服务，目前使用basicHttpBinding、userNamePasswordValidationMode和TransportWithMessageCredential，以下是我的配置：

<behavior name="Secure">
      <serviceMetadata httpsGetEnabled="true" httpGetEnabled="false" />
      <serviceDebug includeExceptionDetailInFaults="true"/>
      <serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom"
                                customUserNamePasswordValidatorType="Kestrel.MIS3.Server.Services.Security.LoginAuthentication, Kestrel.MIS3.Server.Services" />
      </serviceCredentials>
      <serviceAuthorization principalPermissionMode="Custom">
        <authorizationPolicies>
          <add policyType="Kestrel.MIS3.Server.Services.Security.AuthorizationPolicy, Kestrel.MIS3.Server.Services"/>
        </authorizationPolicies>
      </serviceAuthorization>
<behaviour>

<services>
  <service name="Kestrel.MIS3.Server.Services.UserService" behaviorConfiguration="Secure">
    <endpoint address=""
              binding="wsHttpBinding"
              bindingConfiguration="wsSecure"
              contract="Kestrel.MIS3.Server.Services.IUserService" />
    <endpoint address="mex"
              binding="mexHttpsBinding"
              contract="IMetadataExchange" />
  </service>
</services>

<wsHttpBinding>
    <binding name="wsSecure">
      <reliableSession enabled="true"/>
      <security mode="TransportWithMessageCredential">
        <message clientCredentialType="UserName" />
      </security>
    </binding>
  </wsHttpBinding>

[ServiceContract(SessionMode = SessionMode.Required)]    
public interface IUserService

[ServiceBehavior(InstanceContextMode = InstanceContextMode.PerSession)]
public class UserService : ServiceBase, IUserService