title: When custom SecurityTokenHandler gets triggered?
body: <p>I have a simple REST Web Service. I have tried to implement SimpleWebToken security therefor I created a custom SecurityTokenHandler with overridden CanreadToken and ReadToken then I registered it in web.cofig file.</p>
  
  <pre><code>&lt;system.identityModel&gt;
    &lt;identityConfiguration&gt;
      &lt;securityTokenHandlers&gt;
        &lt;clear/&gt;
        &lt;add type="TestTokens.SimpleWebTokenHandler, TestTokens"&gt;&lt;/add&gt;
      &lt;/securityTokenHandlers&gt;    
   &lt;audienceUris&gt;
      &lt;clear/&gt;
      &lt;add value="http://mytestrealm/"/&gt;
   &lt;/audienceUris&gt;
  &lt;/identityConfiguration&gt;
  </code></pre>
  
  <p>I thought that CanReadToken() is always called, in order to make sure that the incoming request can be handled.
  Why it is not called?</p>