How to find out why id_token is not valid?