prohibit the query response mode for id_token or "code token" response
types
This complies with https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#id_token, which says that query response mode MUST NOT be used for id_token type, multi response types including token and/or id_token.
Fixes #87 (closed)