Solved.
I inserted a few more options in the file that generates the final replay on the server and it worked.
I followed the suggestion of https://stackoverflow.com/questions/43622368/save-token-that-comes-in-response-to-api
it looks that you Did not Expose the header correctly, the browser
will not forward this header to your code unless you specify it server
side.
Try Adding this to you $headers Object
$response->headers->set('Access-Control-Allow-Methods', 'POST, GET, OPTIONS, PUT, DELETE');
$response->headers->set('Access-Control-Allow-Headers', 'Content-Type, X-Auth-Token, Origin, Authorization');
$response->headers->set('Access-Control-Expose-Headers', 'Authorization');
$response->headers->set('Authorization', 'Bearer ' . $newToken);
return $response;