Combining claims from authorization server AND incoming principal rather than losing the context provided from the identity provider.