app: add option to force auth refresh