Enforce UsernameToken Password type checking for StaX inbound, removing DOM's PASSWORD_TYPE_STRICT configuration parameter