Hi Ryo,
If that is the case, the Client Application who wants to consume your web service, will not able to generate the correct proxy class.
Let us say, I am using VS to create windows application, then add web reference to your URI. VS suppose to generate the proxy class automatically for me inclusive the security token class which reading from SOAP header Sections of WSDL.
My understanding is WSDL is to say who and what they are provides and how to access them. Sorry if my understand is incorrect.
mandyk