I assumed a user would need to already be logged in for this to make sense, hence the Authorize attribute. I'm not sure this is the right way to do it as the old token is still valid.
I also assumed the endpoint probably shouldn't ask for the login information as this would be no different from the login endpoint.
I assumed a user would need to already be logged in for this to make sense, hence the Authorize attribute. I'm not sure this is the right way to do it as the old token is still valid.
I also assumed the endpoint probably shouldn't ask for the login information as this would be no different from the login endpoint.
Closes #162