STRs outside of <wsse:Security> header

["Conor P. Cahill" <concahill@aol.com>]

Lines 812-814 of the core specificatoin require that uses of the STR
outside of a Security header require that "the meaning of the
response and/or the processing of the reulting references MUST
be specified by the containing element ... "

This is a bit confusing as a "containing element" doesn't typically
specify processing rules (yes, the specification for that containing
element may do so).  This also restricts one from profiling a use of an
STR within an extension area defined in another specification (such as a
profile of using an STR as a child of the WS-Addressing <Metadata> EPR
element).

I would like to propose that we change this to someting along the lines of:

Any use of an STR outside of the Security header is outside the scope of
this specification.  Entities desiring to use the STR element MUST
profile the  meaning of the response and/or the processing of the
resulting references.

Conor