bearer

There are a few things I don't like about this approach:
1. User and Password are sent in a POST request to create a token and on every request to refresh the token
2. Requiring user and password during refresh token will not work with a JS client
3. In CSharp client, refreshing token requires a separate httpClient and thread
4. In JS client (not written here yet), we need AJAX calls to refresh token. Because JavaScript is single thread, there is less guarantee we will refresh the token before it expires.