Best practices for custom claims using OIDC-conformant Auth0.js