token not in response header: response.headers.merge!(auth_header) doesn't seem to work

hello,

problem seems similar to #721, however I checked and it's working properly up to
auth_header = @resource.create_new_auth_token(@client_id) (set_user_by_token.rb:118)
it contains the token etc, but
response.headers.merge!(auth_header)
does not merge it into response.headers (response.headers is not modified after merge!)
auth_header.each do | k,v| response.set_header(k,v) end
works (although merge! seems to do pretty much the same?)

without the extra set_header:

{"X-Frame-Options"=>"SAMEORIGIN",
"X-XSS-Protection"=>"1; mode=block",
"X-Content-Type-Options"=>"nosniff",
"Access-Control-Allow-Origin"=>"",
"Access-Control-Request-Method"=>"",
"Content-Type"=>"application/json; charset=utf-8"}

with:

{"X-Frame-Options"=>"SAMEORIGIN",
"X-XSS-Protection"=>"1; mode=block",
"X-Content-Type-Options"=>"nosniff",
"Access-Control-Allow-Origin"=>"",
"Access-Control-Request-Method"=>"",
"Content-Type"=>"application/json; charset=utf-8",
"access-token"=>"Tor5VzcLxECqgI96rPyQ1w",
"token-type"=>"Bearer",
"client"=>"Ch_C1JoCyTCS46snHKZzuA",
"expiry"=>"1475885872",
"uid"=>"rudi@example.com"}

devise-4.2.0
devise_token_auth-0.1.39
Rails 5.0.0.1
ruby 2.3.1p112

Start in set_user_by_token.rb at line 118 and inspect how auth_header is created and passed to response.headers.merge!. Compare its behavior with the working response.set_header loop using the reported Rails 5.0.0.1 and Ruby 2.3.1 versions. Done means the authentication headers appear in the response without requiring the extra set_header loop.