Enable overriding `client_secret`

This is needed to test against Google.
Add error checks to ID token verification
Add testing goodies to browser example

It can now be made to use Google (sort of).
Fix ID token verification in browser

This fixes #5 ID token handling enhancement

Also, it no longer needs make patch/hack to jsonwebtoken.