Verify UserInfo Response

[hotgazpacho]

According to the OpenID Connect spec, for security reasons, we must verify that the subject of the UserInfo response matches the subject of the ID Token. If they do not match, then the client MUST discard the UserInfo response.

This pull request addresses that, as well as changes the uid to read from the ID Token and not the UserInfo response.

Fixes #62

[coveralls]

Coverage increased (+0.2%) to 99.553% when pulling c6588d3 on hotgazpacho:verify-userinfo-sub into 849b181 on jjbohn:master.

[hotgazpacho]

Perhaps the Travis config needs to be updated to only build on Ruby 2.3? It passes on 2.3.
Or perhaps the gemspec needs to specify a looser version dependency on ActiveSupport?

[hotgazpacho]

Seems like the downstream deps from @nov should be locking to a minimal version of ActiveModel/ActiveSupport. I suggest '>= 4.2', as that's the oldest supported version of Rails

[coveralls]

Coverage increased (+0.2%) to 99.553% when pulling b6096b9 on hotgazpacho:verify-userinfo-sub into 849b181 on jjbohn:master.