I'm not sure, but I think that it's a default behaviour of SOAP responses, it returns always the response wrapped in a tag with the name of the method that was invoked. Can't you manage it from the application who sent the request?

You can see a similar example here. In your case you can set in pResponse the name of the file created and read it from the business process.

Maybe is there whitespaces in context.Prov? Have you tried to remove it? 

if $ZSTRIP(context.Prov,"<>W") = $ZSTRIP(context.ProvName,"<>W")

Your web application is configured to accept just Unauthenticated requests, if you want to use password authentication check it on the configuration.

I think that your application is ignoring the user that you are using and that's the reason because you don't have the proper permissions.

Have the response messages between the business operation and the business process any relevant data? Any info about errors?

Are you catching and logging the errors from the business operation?

Have you tried to import the project into a version lower than 2018.1.4? Maybe the gap between 2012 and 2018 is too large in compatibility terms.

That rings me a bell with something similar that happened to a customer, but in his case was a jdbc connection to a SQL server database configured with the stay connected to -1. The database closed the connection and IRIS received a similar error.