add id_token to response