WSO2 rampart No password supplied by the callback handler - wso2

Question

I have a problem with a WSO2 proxy (ESB v5.0.0) which is secured by a Basic Authentication policy. I have created a simplified test case that shows the issue.
The Proxy service with a security policy calls a backend service which is unsecured. When this call times out, then a diagnostic response is returned to the caller via an "onError" sequence.
When the call to the backend service is made from within an iterator, then the outbound response fails with:
org.apache.axis2.AxisFault: No password supplied by the callback
handler for the user : "wso2carbon"
at org.apache.rampart.handler.RampartSender.invoke(RampartSender.java:76)
at org.apache.axis2.engine.Phase.invokeHandler(Phase.java:340)
at org.apache.axis2.engine.Phase.invoke(Phase.java:313)
at org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:261)
at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:426)
at org.apache.synapse.core.axis2.Axis2Sender.sendBack(Axis2Sender.java:222)
at org.apache.synapse.mediators.builtin.RespondMediator.mediate(RespondMediator.java:35)
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:97)
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:59)
at org.apache.synapse.mediators.base.SequenceMediator.mediate(SequenceMediator.java:158)
at org.apache.synapse.mediators.MediatorFaultHandler.onFault(MediatorFaultHandler.java:93)
at org.apache.synapse.FaultHandler.handleFault(FaultHandler.java:53)
at org.apache.synapse.endpoints.AbstractEndpoint.invokeNextFaultHandler(AbstractEndpoint.java:698)
at org.apache.synapse.endpoints.AbstractEndpoint.onFault(AbstractEndpoint.java:530)
at org.apache.synapse.endpoints.WSDLEndpoint.onFault(WSDLEndpoint.java:58)
at org.apache.synapse.FaultHandler.handleFault(FaultHandler.java:53)
at org.apache.synapse.core.axis2.TimeoutHandler.processCallbacks(TimeoutHandler.java:178)
at org.apache.synapse.core.axis2.TimeoutHandler.run(TimeoutHandler.java:89)
at java.util.TimerThread.mainLoop(Unknown Source)
at java.util.TimerThread.run(Unknown Source)
Caused by: org.apache.rampart.RampartException: No password supplied by the callback handler for the user : "wso2carbon"
at org.apache.rampart.builder.BindingBuilder.addUsernameToken(BindingBuilder.java:207)
at org.apache.rampart.builder.TransportBindingBuilder.build(TransportBindingBuilder.java:95)
at org.apache.rampart.MessageBuilder.build(MessageBuilder.java:140)
at org.apache.rampart.handler.RampartSender.invoke(RampartSender.java:65)
When the iterator is removed, the proxy completes correctly, returning my error message when the backend service times out.
If I remove the security policy then it works correctly both with and without the iterator.
Does anyone have any suggestions what might be the problem? I have simplified the proxy down to the minimum to demonstrate the error:
<proxy name="Tester" startOnLoad="true" transports="https http" xmlns="http://ws.apache.org/ns/synapse">
<target>
<inSequence>
<enrich>
<source clone="true" type="body"/>
<target property="storeBody" type="property"/>
</enrich>
<payloadFactory media-type="xml">
<format>
<Root xmlns="">
<Child/>
</Root>
</format>
<args/>
</payloadFactory>
<iterate expression="//Root/Child">
<target>
<sequence>
<enrich>
<source clone="true" property="storeBody" type="property"/>
<target type="body"/>
</enrich>
<send>
<endpoint key="WSRTE_reg"/>
</send>
</sequence>
</target>
</iterate>
</inSequence>
<outSequence/>
<faultSequence>
<payloadFactory media-type="xml">
<format>
<Error xmlns="">Error</Error>
</format>
<args/>
</payloadFactory>
<header action="remove" name="wsse:Security" scope="default" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-
secext-1.0.xsd"/>
<respond/>
</faultSequence>
</target>
<policy key="gov:ihp360/AA/AA_security_policy.xml"/>
<enableSec/>
</proxy>
To make matters worse, once the error has occurred once, the ESB throws the same error even when the backend does not time out and needs to be restarted before it works again.
Any suggestions?