POST /rooms/:token — Handle both refresh and leave.