Expose WCF Endpoints with REST and SOAP using authentication with simplified configuration - wcf

Question

As usual, trying to find good examples to do exactly what I want is proving difficult.
I've written a WCF Service in .NET 4.5 with simplified configuration, so I've got no services section in the configuration file.
I want to provide SOAP and REST APIs. I also need to restrict access by username and password and I've written a class derived from UserNamePasswordValidator that handles this.
By importing the service reference into a desktop app I can call the service using this code:
var svc = new MyUserService.UserServiceClient();
svc.ClientCredentials.UserName.UserName = "TestApp";
svc.ClientCredentials.UserName.Password = "******";
I expect to be able to call the service from Javascript using something like this:
$.ajax({
url: 'https://domain.userservice.svc',
type: 'GET',
contentType: "application/json",
success: function(data){
},
data: requestData,
headers: {
User: "TestApp",
Password: "********"
}
});
Here's the config file so far, with the SOAP service working.
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="wsHttpBindingConfig">
<security mode="TransportWithMessageCredential">
<message clientCredentialType="UserName" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="">
<serviceMetadata httpGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceCredentials>
<userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="MyAuthenticationModule.Security.WcfUsernameValidator, MyAuthenticationModule.Security" />
<serviceCertificate findValue="TestSelfSigned" storeLocation="LocalMachine" x509FindType="FindBySubjectName" storeName="My" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<protocolMapping>
<add scheme="http" binding="wsHttpBinding" bindingConfiguration="wsHttpBindingConfig" />
</protocolMapping>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
</system.serviceModel>
By blindly following examples from around the web I ended up with this:
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="wsHttpBindingConfig">
<security mode="TransportWithMessageCredential">
<message clientCredentialType="UserName" />
</security>
</binding>
</wsHttpBinding>
<webHttpBinding>
<binding name="webHttpBindingJson">
<security mode="None" />
</binding>
</webHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="">
<serviceMetadata httpGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceCredentials>
<userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="MyAuthenticationModule.Security.WcfUsernameValidator, MyAuthenticationModule.Security" />
<serviceCertificate findValue="TestSelfSigned" storeLocation="LocalMachine" x509FindType="FindBySubjectName" storeName="My" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
<endpointBehaviors>
<behavior name="jsonEndpointBehaviour">
<enableWebScript/>
</behavior>
<behavior name="poxEndpointBehaviour">
<webHttp/>
</behavior>
</endpointBehaviors>
</behaviors>
<protocolMapping>
<add scheme="http" binding="wsHttpBinding" bindingConfiguration="wsHttpBindingConfig" />
<add scheme="httpJson" binding="webHttpBinding" bindingConfiguration="webHttpBindingJson"/>
</protocolMapping>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
</system.serviceModel>
I don't think that I'm too far from it, but I know I'm not there. Can someone finish of the configuration, or point me in the right direction? What url will I need to call from JavaScript?
If I were to add a Web API to support the REST service then I could handle the cross origin issues by catching the request in Global.asax. How will I handle cors in the WFC service.
And a bonus question... I wanted to test the username on my dev machine / password authentication without having to install a certificate and go to https, and apply https later on the deployed site, but this doesn't look possible. Am I correct?
Thanks for helping...