Bean Processor cause WS Security Failure

[ext2]

Hi:

        Following is a simple sayHello Webservice implemented by camel. 
        <from uri="cxf:endpointHello:..."/>
        <bean ref=".." method="..."/>
        The webservice's request is configured to decrypt by server
certificate and response is configured to encrypt by client certificate.

        If I use a bean as following, every thing is ok
                helloBean{
                        void sayHello(Exchange ex){
                                ex.getOut().setBody("hello");
                        }
                }
        ;

        But using following bean , response encryption will failed.
        HelloBean{
                String sayHello(String greet){
                        return "hello";
                }
        }

        the reason is the second bean will propagate headers(also include
security header) from cxf request, it is conflicted with response security.
But the first bean doesn't propagate headers;

        Is it issue of bean processor? cxf component? Or just a document FAQ
to caution the user to filter the security header by himself?