Client credentials flow should not require a subject

[jjg-123]

The client credentials flow can cause an error if no subject is supplied in the phase where the user metadata (for the ID token) are checked. What should happen is that the subject is only verified if the client has explicitly requested the openid scope, so even if the client is configured with one, it should be optional.

Until this is deployed, add the parameter sub=XXX, where XXX is any subject you care, e.g. service.