- solve issue #1
- add configurable claim name for the REMOTE_USER variable, optionally
postfixed with the issuer
  the default for the remote username is "sub@" now, to make it unique
across OPs
- some refactoring of id_token validation functions
printout issuer in metadata validation routines