Add certificate path validation for X.509 tokens in the STS