Remove the id_token storage, store the id_token with the authorization code when needed. Have the code grant type return an id_token when found.