Support for the 'sub' attribute in JWT assertions.

This commit adds support for the undocumented 'sub' attribute required
by some of the Google Admin SDK APIs, such as the Directory API, in
order to work with service accounts.  The 'sub' parameter is set to the
email address of a super-user and seems to have a role similar to that
of the 'prn' parameter.