Use array index, not reset

Passing the return value of a function ('explode') by reference
(the first argument to reset()) is not permitted and will generate
a warning in strict mode.

Use array index notation to retrieve the first element instead.
Ensure the user approved the openid scope

It is possible for a user to click the "Authorize" button, yet
uncheck the box to provide the openid scope.  This returns a
valid (yet useless) access_token, and no id_token.  Handle this
case and throw an exception.