We should expose auth token in response headers so it can be used to update the auth token stored on the client, similar to what's shown in this Apollo link: https://github.com/benawad/slack-clone-client/blob/31_fix_auto_refresh_of_jwt_tokens/src/apollo.js#L18-L36

We are doing this already with the refresh token. PR is below.