How do I host an active STS in ASP.NET MVC 4?

Question

I'm attempting to host an active STS endpoint in my ASP.NET MVC 4 site (which already successfully hosts a passive STS endpoint). For some reason, the WCF runtime does not seem to be "handling" calls to my servive URI.

In my RouteConfig.cs file, I have this:

routes.Add(new ServiceRoute("tokens", new MyTokenServiceHostFactory(), typeof(MyTokenServiceConfiguration)));

That, I believe, is the correct way to host a service without a .svc file. In my web.config file, I have this:

<system.serviceModel>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true"/>
    <!--(behaviors etc)-->
    <services>
        <service name="System.ServiceModel.Security.WSTrustServiceContract">
            <endpoint address="" binding="ws2007HttpBinding" contract="System.ServiceModel.Security.IWSTrust13SyncContract"/>
        </service>
    </services>
</system.serviceModel>

This hunk of configuration can be successfully used to self-host the service, the only thing I have changed is the address of the endpoint.

When I attempt to call the service, I get:

System.ServiceModel.Security.MessageSecurityException: An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail. ---> System.ServiceModel.FaultException: The message could not be processed. This is most likely because the action 'http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue' is incorrect or because the message contains an invalid or expired security context token or because there is a mismatch between bindings.

Logged in the service trace is:

System.ServiceModel.EndpointNotFoundException There was no channel that could accept the message with action 'http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue'.

What have I done wrong here?