Basic - 4 unclear wording for Userinfo endpoint - subject binding

[Former user]

The wording "subject of the Userinfo endpoint" doesn't make sense, not clear how OAuth 2 protected resource endpoints can have subjects.

[hideki nara]

Section 4 of Basic looks euphemistic. Referring to Bear Token may be simpler and clearer.

[Nat Sakimura]

Write that :

Note: UserInfo response is not guaranteed to be about the Subject in the session. Therefore, it MUST NOT be used as an assertion about the user in the session unless the user_id matches the user_id in the ID Token.

[Edmund Jay]

fixes #83

→ 18c03b2fd488