Newly-registered users may have to sign in twice (or just refresh?) for notifications service to work

[athewsey]

Each user needs the appropriate IoT policy attached to their Cognito identity to have access to the notifications service...

However the only hooks available to us are on Cognito user (currently using PostAuthenticated) - and the identity is created after the user logs in.

So the app currently makes a best-effort attempt to attach the policy to the Cognito Identity, but it could fail or the timing could work out wrong when first registering & logging in - resulting in the user having to refresh the page, or maybe even log out and in again, for their IoT (PubSub notifications) permissions to get set up.