Setting scope in access_token breaks id_token