How to include Authorization Extension data (groups/roles/permissions) into issued tokens?