Right now the user info variables (as headers, from JWT claims or from webhook response) are converted into map of strings to strings. Support should be added for lists as well. Then in the permission system _in can be used with session variables.

See #1314