I feel weird about calling this class `Session`, since it can potentially get confused with the user's cookie-based session. At first I called it `AuthToken` but that also felt weird because it holds two kinds of tokens in it, one of which is called an auth token... Any suggestions are welcome!