Clean up permitted attributes for return authorizations
Add validation to prevent exchanges of ineligible variants