set cookie at login with refreshtoken, and us a session token once logged in.when session expires get new token from refreshtoken in cookie