Refresh expired access_tokens [#35]

Note that in order to have @fresh_access_token set before rendering
starts, current_user needs to be a before_filter. You might think that
it's sufficient to have it called implicitly when the templates check
user_logged_in?, but apparently not--looks like template ivars are set
once at the start of rendering and not updated live.
Move token acquisition logic into the User class
Extract some duplicated code