Track and use refresh tokens.

Now instead of requiring the user to log in or do some similar action once their access tokens expired (after a day), we can use the refresh token to get a new access token.