We do not support WSE at this time as we've chosen not to expect or require additional add-ins or toolkits to implement security. When consuming web services the Object Mapper uses Visual Studio automation to create a web reference; when using a WsQuery to call web methods on the service we use the SoapHttpClientProtocol proxy class created by the reference - we have not done any testing to see how this works when using the WSE3 add-in.
The WsQuery does support both Soap Headers and credentials, and we support all the internal security mechanisms used with database-backed business objects.
We also plan to support WCF and its security features in a future release.