Add attr_encrypted

This is useful in authn specs for old migrations