guwer

### Question / Issue In version 2.6.0 id_token in response from refresh token request was added (in #3458). I think this should be at least disabled by default or removed...