我可以在AppEngineTokenSource中设置Subject（又名Prn）吗？

I'm trying to call the Admin sdk from google AppEngine using Go, I have already done the following:

• Added Admin SDK to my appengine project
• added the appengine-project-name@appspot.gserviceaccount.com to the service accounts for the project

Following the example here https://godoc.org/golang.org/x/oauth2/google#example-AppEngineTokenSource

I'm getting: Error 403: Not Authorized to access this resource/api, forbidden

When I did this from the command line, I had to set the Subject account. Is there a way to do this with AppEngineTokenService?

client := &http.Client{
    Transport: &oauth2.Transport{
        Source: google.AppEngineTokenSource(ctx,
            "https://www.googleapis.com/auth/admin.directory.user"),
        Base: &urlfetch.Transport{
            Context: ctx,
        },
    },
}

svc, err := admin.New(client)
if err != nil {
    fmt.Printf("Error getting svc
")
    ctx.Errorf("error getting service %v", err)
}
usersvc := admin.NewUsersService(svc)

listcall := usersvc.List()
listcall.Domain("example.com")
users, err := listcall.Do()