SSL Inside a BPEL?

Today I've been experimenting with SSL/HTTPS in Glassfish.  I'm working with a BPEL that includes an invocation of an EJB.  The BPEL and the EJB are deployed in the same SA.  I changed the EJB to use HTTPS, which seemed to work.  The invocation of the BPEL is through a normal HTTP SOAP request.  When the BPEL comes to the invoke element to the now secure EJB WSDL, I get an exception:

javax.xml.ws.soap.SOAPFaultException: Security Requirements not met - No Security header in message

Is this normal?  The BPEL can not invoke an EJB through HTTPS even internally, and even though the EJB is in the same SA?

Thanks