closer to re-auth sessions
more features
added (untested) access token refresh