as opposed to the openid token