save extended properties on session
add user deserialization middleware
only save extended attributes in auth
Merge branch 'master' into auth
merge basic authentication