Add auth_time to ID token

Since we now support the max_age request parameter, we need support for
returning auth_time in the ID token (it is required if max_age is
specified).