let access token handler to be a public value to ease lookup

[Sorah Fukumori]

• let handler_dgst → handler in a log
• include handler value in ID token
• may need a longer secret value to ensure level of security