Standardize auth token responses

[joshuagraber]

Context

There are several paradigms for auth API responses with access tokens and refresh tokens. Originally this was built without refresh tokens (not a great idea). @maxachis updated the /login endpoint to return this:

But the /refresh_tokens endpoint still returns this:

Requirements

• Standardize access/refresh token responses to use the following shape:

{
  access_token: String,
  refresh_token: String,
  message?: String
}

• Move /login and /refresh_tokens into the /auth namespace.

Tests

I'll leave that up to @maxachis

Docs

• Add docstrings to generate endpoint API docs

Open questions

• Not at the moment

[maxachis]

@joshuagraber Should I assume this also means that we will be regenerating the refresh token and invalidating the prior one when /refresh-session is called? That appears to be the standard, from what I've glanced at, but I want to double check.

[joshuagraber]

Yes @maxachis, I think that's usually the best way to go about it.