improvement: allow configuring extra claims for a user

[zachdaniel]

This is only half done. We still need to do one thing which is to modify the store_in_session helper to

1. take opts and store the claims in the session so that they can be added to the user in LV hand off or when loading from the session.
2. modify load_from_session and assign_new_resources to use the claims info from the session.

This allows for

1. claims to be stored in the token that the client can read
2. those claims to be used for writing policies/checks etc.

Now, in most setups, I would say not to store additional claims in the JWT and then actually use that information for authorization, but it is a legitimate optimization in many cases, or in situations where just being in possession of a given token is sufficient to authorize certain actions etc.