ws-securitypolicy clarification

Can someone with 
more practical experience with ws-securitypolicy please help clarify something 
for me? If I want to include a token assertion inside of a SupportingTokens 
assertion and attach that to a message in WSDL (not the endpoint), how should 
the IncludeToken attribute be used? Do I just eliminate all recipient -> 
initiator options so the resulting values that only make sense are now Never, 
Once, and AlwaysToRecipient? The default value listed in the spec is Always 
which includes recipient -> initiator which I guess in this case would 
really act the same as AlwaysToRecipient. And, I would also assume that 
initiator and recipient are relative to that message only, so the initiator and 
recipient roles would be reversed when attaching policies to the output 
message.

 

Thanks,

Tony