SSL-over-SOAP: Towards a Token-based Key Establishment Framework for Web Services