Added HTTP interceptor with some refactoring.
Added comments to auth service.
Added client-side user flush after change on server side.
Added token refresh also for non-protected paths.