Hybrid client-server authentication

With the gem's current version you cannot make a hybrid client-server authentication, and the gem always tries to get access_token from the Google server by authorization_code. And because authorization_code and access_token must be queried with the same redirect_uri parameter, it fails.

After 2 days of googling around I found a way to verify access_token by id_token with an extra query https://www.googleapis.com/oauth2/v2/tokeninfo which takes two parameters id_token and access_token and returns the result if the parameters are valid.

Example of javascript code:
``` javascript
  jQuery(function() {
    return $.ajax({
      url: 'https://apis.google.com/js/client:plus.js?onload=gpAsyncInit',
      dataType: 'script',
      cache: true
    });
  });

  window.gpAsyncInit = function() {
    $('.googleplus-login').click(function(e) {
      e.preventDefault();
      gapi.auth.authorize({
        immediate: true, 
        response_type: 'id_token token', 
        cookie_policy: 'single_host_origin',
        client_id: '000000000000.apps.googleusercontent.com', 
        scope: 'https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile'
      }, function(response) {
        if (response && !response.error) {
          // google authentication succeed, now post data to server and handle data securly
          jQuery.ajax({type: 'POST', url: "/auth/google_oauth2/callback", dataType: 'json', data: response,
            success: function(json) {
              // response from server
          });
        } else {
          // google authentication failed
        }
      });
    });
  };
```