title: ID token or /userinfo for Identity assertion
body: <p>After authenticating with a provider, an application will often receive both an ID token and an access token on behalf of the user. Now it seems there are two ways to assert who the user is.</p>
  
  <ol>
  <li>Verify the ID token and then read the ID token. </li>
  <li>Pass the access token to the userinfo endpoint and read the JSON response. </li>
  </ol>
  
  <p>Both seem like acceptable avenues, but are there certain scenarios in which one or the other should be used?</p>