Embed extension data in the headers

The token verification response can have all sorts of extension
data that the auth_token.py middleware doesn't include in any
headers.  This adds optional headers which will contain any
extension data that was present in the verification response.

Change-Id: Icf5b540958c933f9e7961d9d7a867fb62b1d141d