added try catch around verifySignedJwtWithCerts in verifyIdToken

verifyIdToken is not throw safe because verifySignedJwtWithCerts throws. 

but we can't simply wrap the verifyIdToken call in try catch because the call to verifySignedJwtWithCerts is async. 

also returning the error seems more helpful than just a generic error string.