Return the token in the Response.authorisation field rather than using a custom response object