token-server: Make machine token minter config apply to subdomains.

tokenserver/appengine/impl/machinetoken/machinetoken_test.go

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package machinetoken
 
 import (
         "crypto/x509"
         "math/big"
         "testing"
@@ skipping 25 matching lines @@
                                                 MachineTokenLifetime: 3600,
                                         },
                                 },
                         },
                 }
 
                 Convey("good params", func() {
                         So(params.Validate(), ShouldBeNil)
                 })
 
+                Convey("good params with subdomain", func() {
+                        params.FQDN = "host.subdomain.domain"
+                        So(params.Validate(), ShouldBeNil)
+                })
+
                 Convey("bad FQDN case", func() {
                         params.FQDN = "HOST.domain"
                         So(params.Validate(), ShouldErrLike, "expecting FQDN in lowercase")
                 })
 
                 Convey("bad FQDN", func() {
                         params.FQDN = "host"
                         So(params.Validate(), ShouldErrLike, "not a valid FQDN")
                 })
 
-                Convey("bad char in FQDN", func() {
-                        params.FQDN = "host@.domain"
-                        So(params.Validate(), ShouldErrLike, "forbidden character")
-                })
-
                 Convey("not whitelisted", func() {
                         params.FQDN = "host.blah"
                         So(params.Validate(), ShouldErrLike, "not whitelisted in the config")
                 })
 
                 Convey("tokens are not allowed", func() {
                         params.Config.KnownDomains[0].MachineTokenLifetime = 0
                         So(params.Validate(), ShouldErrLike, "are not allowed")
                 })
 
@@ skipping 49 matching lines @@
 
 func (fakeSigner) Certificates(c context.Context) (*signing.PublicCertificates, error) {
         panic("not implemented yet")
 }
 
 func (fakeSigner) ServiceInfo(c context.Context) (*signing.ServiceInfo, error) {
         return &signing.ServiceInfo{
                 ServiceAccountName: "token-server@example.com",
         }, nil
 }