Change to use MachineKey protection
Only include claims from ids