Bug Fix: Move JWT from metadata to data

Previously, after a successful password grant, the login operation returned the JWT in the metadata response element. This meant that when the audit backend logged the login operation the JWT was logged in raw form. By placing the JWT in the data response element, this is addressed: the JWT is HMAC'ed in the logs as it should be.