I too have just encountered this issue. I came across a blog post Darwin-IT: SOA Gateway Service Invocation Framework: Test Service highlighting the issue and a comment indicating that it may be related to proxy configuration (see Oracle E-Business Suite Integrated SOA Gateway Implementation Guide). I am going to follow this lead, hopefully this can be of some help to you too!
You need the SoapUI tool from soapui dot org. It provides the flexibility to edit the security header (and all other sections).
Today I finally got my EBS SOA working, I'll try to test your values tomorrow.
The difference maker for me was soapUI- easy install, simple default install, no config required.