ensure all allowed attributes are sent via postMessage after OAuth