clarify that tenant for microsoft is sub for google service account

[macMikey]

in the oauth2 docs, one of the fields is tenant, which is the username that we are acting on behalf of. google calls this sub. it is described under "additional claims", here

[macMikey]

Or, even better, let's close this issue and handle it via #71