Invalid user signs in but no header tokens are returned

I am not sure if this is the intended functionality, but when a user signs in but has invalid data the user data will still be returned. The access token headers however are not returned and this failure happens silently. An error should be raised if the user is invalid. See the update_auth_headers function.

Start by reading the update_auth_headers function and trace the invalid sign-in path described in the issue. Reproduce the case with invalid user data, then verify that it raises an error instead of silently returning user data without access-token headers.

Written by the indexing model from the issue text.