More restrictive caveats.

Add user tag to identity provider third-party caveat condition.
Add expiration time first party caveat to Juju's macaroon.