each request should have valid ID Token

Each incoming request is expected to have signed non-expired JSON Web Token, containing information about user (sub), matching edx-notes client id (to be set in provider's database) and signed with edx-notes client secret (the same). 

https://openedx.atlassian.net/browse/TNL-780
we do not use `django.contrib.auth` here, we do not even have users or sessions, we do not set cookies. In fact, we do not have database at all.