Hmm, looking more carefully, we only set attrs in app/services/sso/apache.rb's additional_attributes under the