> A Google App Engine app, for example, wouldn't be able to use sqlite to save a token.)

Yeah when I tried to implement this it turned into a terrible mess. I definitely don't think we want to have to bake this into the library.

However your suggested approach sounds pretty good to me. Maybe what we should do is store the entire response from `get_raw_access_token` on the Session object. That way the formatting doesn't matter and consumers are free to parse it however they want/need. Then the refresh token can be passed in via `get_session` and then rauth goes through the access token dance again.

> if a protected resource request fails due to an invalid token, automatically try to refresh the token

I guess it worries me that an invalid token response from a provider may not be consistent. In other words Facebook might give you a JSON blob with an error and another service might do something completely different. Otherwise this sounds like the right thing to do.