apps: allow empty attribute values with -subj