API Design of login and refresh JWT token endpoint questions - C#