Revamp /reset-session endpoint?`

[maxachis]

Context

Currently, the /refresh-session endpoint to refresh an access token has a bit of an unusual structure:

• It accepts the access token for bearer authentication (bear in mind that if this token is expired, this refresh would not work)
• It then accepts the refresh token as a JSON entry.

This might not be necessary, and it can make handling the refresh logic more cumbersome on the user end! It might make more sense to simply provide the refresh-token as the Bearer Authentication, with no JSON body.

Requirements

• Determine, with @joshuagraber, whether this indeed makes the most sense, or if we should stick with the original (or an alternative design)
• Whatever we decide on, implement it!

Tests

• The test for /refresh-session should additionally check to confirm that it still functions even when the previous access token is expired (which currently it does not do)

Docs

• Documentation will need updated

Open questions

• See above.