userinfo endpoint now uses same sub value as id_token