New Web Services Security Spec Under Way