use permitted_user_attributes to allow extension

Fixes #137