Include session attributes in JWT token

Special session attributes should be able to be whitelisted via a property and included in the JTW token. Attributes should additionally be handled on the API side.