Confusion around how to use id_token and access_token