use the x-ext instead of x-attributes field from the token introspection endpoint, x-entitlement is now returned as array by the AS, update tests to reflect this