Make JWT key-value pair parsing more robust to small changes (e.g., spaces)

[mskd12]

Also add stricter parsing: check that the prefix is "sub" or "aud" (depending on the claim under check)