use cases for bearer id token? (authorization)