Chore: Strip `JWT` from URL once authenticated

As noted in https://github.com/dwyl/auth/issues/268 the `JWT` for a successfully authentication session remains in the `URL`:

This is undesirable because if there was a _malicious_ `` on the page
or someone loaded an `` on the page that made an outbound `HTTP Request`,
the `JWT` would be in the referrer header of the request
and thus the session could be compromised.
i.e. a malicious actor could just extract the `JWT` from their logs
and replay it to gain access to everything the `person` has saved in the dwyl `App`.

> **Note**: this is not an "active exploit". We are still testing our `MVP`.
Nobody has stored any personal/private/important data in the `MVP`
and there has not been any indication of anyone malicious attempting to "steal" a `JWT`.
I am opening this issue _proactively_ to resolve this ***`before`*** it becomes an exploit.

# Todo

+ [ ] Strip `jwt` from `URL` once the session has been established.

> **Note**: this will be rolled into the `V2` update "Coming Soon" ... 🔜
So please ignore it until then. 👌