Either of those sound good to me.

The second case I considered, but I was wondering how follow up refreshes would work? I think the refresh token is always received at the get_access_token step, so once received it can be consumed but then what happens after that point? I guess it could try to just refresh on every request, making a call to get_access_token?

Would an accessor just be an attribute on the session?