Add custom fields to payload AFTER action is called

Imagine we want to log the user id or some session variables, this will be called before any before_filter, including the rails before filter that handles csrf.

This can be bad, for example, [devise memoizes the current resource](https://github.com/plataformatec/devise/blob/master/lib/devise/controllers/helpers.rb#L58), this means that if we want to add ``current_user.id`` to the custom fields, it will be computed before rails can nullify the session (default behaviour), meaning that CSRF protection will be completely bypassed.