Should we be sanitizing the tenant displayName as well? Not sure, probably not as it should be coming from a trusted user?