WCF "Simple" security

Hi,
I am bit confused by some of the security options in WCF.

Are WSHttpBinding messages encrypted by default?

What is the simplest way to implement the following:
Secure transport (https? or is there some inbuilt encryption mechanism for messages)
Ensure integrity of message
Pass username/password

It is for an application that will be communicating over the internet to a web based service.

I dont want to use any of that generating certificate stuff as it looks a pain to deploy.**It would be nice to give some kind of session token as well so we would not have to authenticate the user each time.

I guess the most straight forward way is to use SSL and just pass a username, password into the service?

Thanks,

Alex