verify the id token