Endpoint Discovery + Token Validation

- Use openid-configuration discovery url to detect varies endpoints
- Proper handling of token signatures (sometimes the first key in the array might not be used to sign the token)

P.S. it doesn't seem to me that the $jwt (id_token) needs to be put in session. I might be wrong but i haven't tested that path. Do you think you can give that a spin?

TBD: figure out caching
this is the id_token, i will rename the parameter