Use X509 instead of SecurityToken as BST wsu:Id.