Fix id_token generation when allow_implicit is FALSE.
Add tests for the Authorize Controller.