add session refresh support, clean up redirect_uri