Don't require request to contain google_id.

This information is embedded in the ID token already as the sub field.
All flows in OpenID Connect Core 1.0 specify that the token should
be validate then the Subject Identifier should be retrieved.

Subject Identifier is not involved in the validtion process according
to section 3.1.3.7:
http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
Respect expiration field.

Expired tokens should not pass verification.  OpenID Connect Core 1.0
says these should not be processed.
http://openid.net/specs/openid-connect-core-1_0.html#IDToken

Possible enhancement would be to allow the user to specify a leeway
per Spec's suggestion.
Add missing dependency on request.
Merge pull request #1 from themikenicholson/master

Two small changes to comply more closely with OpenID Connect Core 1.0