aud verifies if aud is passed in, :sub does not

[skippy]

If you pass in :aud and :verify_aud, then it will fail if :aud is not in the payload.

the equivalent is not true for :sub. If you pass in :sub but it is not in the payload, it won't do anything. I would expect the behavior of :aud, which is if you ask to verify_sub, it will fail if it isn't in the payload.

if that sounds reasonable, I'll submit a patch. thanks!

[excpt]

It should behave like the :aud validation.