title: Spring-WS 2.3.0 Security Header Validation with WSS4J 2.1.4 - NoSecurity won't work
body: <p>I'm using Spring-WS for Client an try to update to the newest version. Allthough configured not to validate incoming security header the new Wss4jSecurityInterceptor throws Wss4jSecurityValidationException("No WS-Security header found").</p>
  
  <pre><code>&lt;bean id="wsSecurityInterceptor" class="org.springframework.ws.soap.security.wss4j2.Wss4jSecurityInterceptor"&gt;
    &lt;property name="securementActions" value="UsernameToken"/&gt;
    &lt;property name="validationActions" value="NoSecurity"/&gt;
    &lt;property name="securementPasswordType" value="PasswordText"/&gt;
    &lt;property name="securementUsernameTokenElements" value="Nonce"/&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>In my opinion it's because Spring-WS 2.3.0 and WSS4J 2.1.4 are incompatible at this point.</p>
  
  <p>Wss4jSecurityInterceptor fills the field validationActionsVector as follows:</p>
  
  <pre><code>public void setValidationActions(String actions) {
    this.validationActions = actions;
    try {
      validationActionsVector = WSSecurityUtil.decodeAction(actions);
    }
    catch (WSSecurityException ex) {
      throw new IllegalArgumentException(ex);
    }
  }
  </code></pre>
  
  <p>where WSS4J in case of NoSecurity returns in WSSecurityUtil an empty List:</p>
  
  <pre><code>public static List&lt;Integer&gt; decodeAction(String action) throws WSSecurityException {
      String actionToParse = action;
      if (actionToParse == null) {
          return Collections.emptyList();
      }
      actionToParse = actionToParse.trim();
      if ("".equals(actionToParse)) {
          return Collections.emptyList();
      }
  
      List&lt;Integer&gt; actions = new ArrayList&lt;&gt;();
      String single[] = actionToParse.split("\\s");
      for (int i = 0; i &lt; single.length; i++) {
          if (single[i].equals(WSHandlerConstants.NO_SECURITY)) {
              return actions;
          } else if ...
  </code></pre>
  
  <p>But Wss4jSecurityInterceptor checks for an NoSecurity-Item in the list:</p>
  
  <pre><code>@Override
  protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
          throws WsSecurityValidationException {
      if (logger.isDebugEnabled()) {
          logger.debug("Validating message [" + soapMessage + "] with actions [" + validationActions + "]");
      }
  
      if (validationActionsVector.contains(WSConstants.NO_SECURITY)) {
          return;
      } ...
  </code></pre>
  
  <p>Is this a known issue? Does a workaround exist? Or do I have to override the method in WSS4J to fill the list with the expected item?</p>