oauth2: Remove exp and iat from ID token header

[aeneasr]

{
  "alg": "HS256",
  "iat": 1519302684,
  "exp": 1519306284
}

[mdziemianko]

seems like that might break compatibility with some standard python librariees like flask oidc (it uses itsdangerous see https://github.com/pallets/itsdangerous/blob/master/itsdangerous.py)

[aeneasr]

It doesn't belong there though, the spec clearly puts it in the JWT claims.

[aeneasr]

It wasn't a bug in hydra but the mentioned library instead.