A token with no "sub" field is now treated just like one with an
empty "sub".  In addition, all times are treated with a slack of 5s.