response now includes idToken so the user can be authenticated on the server.