Add a new check in CreateIdentityToken to ensure that a sub claim is always present in the id_token