Moved id_token from session to its own cookie.