As AccessToken and RefreshToken extends IDToken they contain the ID Token claims. If
I've read the spec correctly those claims should only be in the ID Token. There should
also be a separate UserInfo endpoint which we're missing.
Is there a reason why AccessToken extends IDToken, or can we remove that?