Exchange the refresh token cookie for a new access token

Reads the refreshToken cookie set by /api/v2/auth/token, rotates it and answers with a new access token. Needs no Authorization header, so it keeps working once the previous access token has expired. The rotated cookie is returned in Set-Cookie; the token itself is never part of the body.