Currently a IllegalArgumentException is thrown if the caller subject is null. There is an use case where caller run-as can be non-null wherein the subject is not necessary.

So flag an error only when both callersubject and caller run-as are null.