Corrected logic of setting additional authorization attributes to avoid ClassCastException as they are returned as Map by CheckTokenEndpoint.