I see a couple of commented lines here:
1. //signingTokens.Add(new X509SecurityToken())
2. //return new IssuerTokenResolver();
Please add a comment on both. The first one looks very suspicious, though.