Rotate a live customer session (presented refresh token is single-use)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.