/api/token needs to be defined before /api/*

This wasn't breaking anything too serious. It meant that the frontend
could not auto-fetch new tokens after their TTL expired during
extremely long sessions.
Comments