use refresh token

A logout button should be added