verify at_hash when both access token and id token are present in response