fix: backchannel logout token may not contain "sub"

[prigaux]

The spec says:

A Logout Token MUST contain either a sub or a sid Claim, and MAY contain both

Ory Hydra OP never sends "sub".

The fix is really trivial: ignore "sub" if it is missing.

[julien-nc]

Thanks for the PR!

So according to the specs, the IdP could include sub but not sid in the logout token.

A full fix would be:

• sid is there: we use it and don't check the sub
• sid is missing: we try to use the sub
  • sub is there: we use it to get the session stored in the db (just like we currently do with sid)
  • sub is absent: we return an error response

In any case, we keep checking the iss.

Would you be ready to implement this fix? If not, I can do it later, after we've merged this PR.

[julien-nc]

The specs are actually more complex than what i described. It's a good first step to support the absence of the sub. Thanks!