Added requestUsingIDToken configuration

[ddaddy]

Fixes #405 as it allows the use of the id_token instead of the access_token when signing requests.
This is handy when using AWS Cognito with AWS API Gateway.

[jozefizso]

I don't think this is a good change.,

The ID token should not be used for authentication.

As said above, an ID token proves that a user has been authenticated. In a first-party scenario, i.e. in a scenario where the client and the API are both controlled by you, you may decide that your ID token is good to make authorization decisions: maybe all you need to know is the user identity.

However, even in this scenario, the security of your application, consisting of the client and the API, may be at risk. In fact, there is no mechanism that ties the ID token to the client-API channel. If an attacker manages to steal your ID token, they can use it to call your API like a legitimate client.

If your API accepts an ID token as an authorization token, to begin with, you are ignoring the intended recipient stated by the audience claim. That claim says that it is meant for your client application, not for the resource server (i.e., the API).

You may think this is just a formality, but there are security implications here.

https://auth0.com/blog/id-token-access-token-what-is-the-difference/