Rather than using a custom response to return the token, it's expected that the token will be returned in the `Response#authorization` field.