BE-returned token is just checked for presence, it should be validated (`src/app/auth/auth.guard.ts`)