Enable an event subscriber dynamically (the right way)

AppBundle.php

<?php

namespace AppBundle;

use AppBundle\DependencyInjection\Compiler\SecureApplicationPass;
use Symfony\Component\DependencyInjection\Compiler\PassConfig
use Symfony\Component\DependencyInjection\ContainerBuilder;
use Symfony\Component\HttpKernel\Bundle\Bundle;

class AppBundle extends Bundle
{
    public function build(ContainerBuilder $container)
    {
        $container->addCompilerPass(new SecureApplicationPass(), PassConfig::TYPE_BEFORE_REMOVING, 10);
    }
}

SecureApplicationPass.php

<?php
class SecureApplicationPass implements CompilerPassInterface
{
    public function process(ContainerBuilder $container)
    {
        if ($container->hasParameter('enable_subscriber')) {
            $definition = $container->getDefinition('app.token_subscriber');
            $definition->addTag('kernel.event_subscriber');
        }
    }
}