Expose access_token to client after login; capture token on client and add to headers after login; remove from headers on destroy