rework AccessToken, RefreshToken, State
more cleanups in Token/State/AccessToken/RefreshToken
fix PDO storage, update README
add warning about SQLite directory that needs to be writable