Part 2, Section 5.2.2.: remove response type "code id_token token"

[Torsten Lodderstedt]

the latest revision of the OAuth 2.0 Security Best Current Practice recommends implementors to discontinue use of response types issuing access tokens in the front channel (https://tools.ietf.org/html/draft-ietf-oauth-security-topics-09#section-2.1.2).

This also hold true for "code id_token token" since the issued access tokens cannot be sender constraint.

Note: FAPI Part 2 also recommends holder of key, which cannot be fulfilled with "code id_token token"

I suggest to remove "code id_token token"

[Nat Sakimura]

Remove.

[Joseph Heenan]

removed response type "code token id_token"

closes #193

→ <<cset 5ccf88a7788a>>