While there are plenty of mentions online that SoapServer doesn't support SOAP Headers, this isn't true.
In your class, if you declare a function with the name of the header, the function will be called when that header is received.
<?php
class MySoapService {
  private $user_is_valid;
  function MyHeader($header) {
    if ((isset($header->Username)) && (isset($header->Password))) {
      if (ValidateUser($header->Username, $header->Password)) {
        $user_is_valid = true;
      }
    }
  }
  function MySoapRequest($request) {
    if ($user_is_valid) {
      }
    else {
      throw new MyFault("MySoapRequest", "User not valid.");
    }
  }
}
?>