The Policy engine obeys instructions encoded as assertions. When these
assertions refer to a security token, the policy engine will try to find
a matching token and use it to perform either the sign or encrypt
operation and, optionally, inject the token into the message.

When searching for a token, the policy engine will look in the
SoapContext for the security token and, if it is not found, will then
search the PolicyEnforcementSecurityTokenCache for a match.

This is why placing the token in either location will work; placing it
in the PolicyEnforcementSecurityTokenCache has the benefit that your
application can perform this operation one time rather than per proxy /
per message.