Generate a better idToken.
Only first 4 bits of each byte is used so we ended up
with duplicate responses if there were a lot of consecutive
requests done.
Now it masks of anything but the last 4 bits so that
we have a correct token to match against.
Closes #4