token will only contain this field if it's requested in scopes

this just checks that the token was signed using one of the keys listed
by the key server. still need to validate the token contents.

This reverts commit 02c9653.

`sub`, `email`, `family_name`, `given_name`

regular registrations also allow this

Playing around with the server a little bit, I see lots of instances of
MicrosoftAuthenticator being created (and, interestingly, each log-in
request creates a new instance), but the instance being used is always
the same: the one that's been passed in to userAuthenticationManager,
which is a singleton. It's possible that my local app is uses less
threads than the live app, but even on the live app. However, because
the exchange and token access happen while serving the same request,
I think it's guaranteed that we only ever access the cache from within
the same thread.

when an authentication code cannot be extracted from the callback,
return an error rather than just throwing 500

This reverts commit 9d9d4ef.

use our own exceptions, with our own messages. this way, we avoid
leaking potentially sensitive information to an attacker.

MSAL4J automatically requested this. A string-replace worked for
removing the scope from the authorization URL, but the `/token` endpoint
also needs scopes, and I didn't find an easy way to modify the behavior
of `.acquireToken`. I ended up just using the same lib used
 for Raspberry PI and Google authentication.