First few requests never get the authorization header

[artlowel]

When you are authenticated, and you refresh, the first few rest requests won't contain the authorization header.

The problem is easiest to see in dev mode, as you can simply inspect the requests in the dev tools and look at their headers, but it also happens in production mode, on the express server.

If you add the following statement to auth.interceptor.ts, line 251 you can see in the server output that it happens during server side rendering as well

console.log(newReq.url, 'authorized', isNotEmpty(newReq.headers.get('authorization')));

This is problematic because as we're adding support for things like the authorization endpoint to decide which menu options to show etc, the responses to those very first requests depend on having the correct authentication info.

[atarix83]

@artlowel A possible solution to this problem, should be to active router-outlet only once the auth.loaded state is true. In this way it should prevent to load any route, thereby to make new request, before an attempt to restore an existing auth session is done.

[artlowel]

@atarix83 explained in the meeting today that we could also wrap a container with an ngIf="auth.loaded" around everything in app component instead of just the router-outlet. That should prevent any other requests from being fired too soon

[artlowel]

assigned myself, as we'll fix this in the context of #635