interlock (through memcached) when refreshing token
many minor fixes
token is discarded 100 s before it really expires