'nbf' not handled correctly

[DaWalker]

I think JwtTokenBuilder.java:145 should be computing the difference between the 'iat' (issuedAt) time and the 'nbf' (notBeforeTime), but it is computing the sum instead.

e.g. (using small values for the sake of clarity) if 'iat' is 1000 and 'nbf' is 900, the leeway should be 100 (issuedAt - notBefore), not 1900 (notBefore + issuedAt).

[andreacomo]

You' right. I made a test to prove and fix it, thank you.
Fix will be available from version 2.0.1 for Tomcat 8 and 1.1.1 for Tomcat 7