also add x-attributes to introspection endpoint if they are available depending on authentication backend