Don't remove claims from incoming principal

Combining claims from authorization server AND incoming principal rather than losing the context provided from the identity provider.

e.g. If an Email Address claim is provided by the Identity Server, the Authorization server (without this change) would strip that claim from the principal that is passed on.