Corrected logic of setting additional authorization attributes to avoid ClassCastException as they are returned as Map by CheckTokenEndpoint.

I'm really sorry that I didn't notice that previously.
**CheckTokenEndpoint** returns additional authorization attributes as Map (cause they are initially formed as JSON). Without these changes **java.lang.ClassCastException: java.util.LinkedHashMap cannot be cast to java.lang.String** will be thrown.