refresh-token support (pass 1)

Added this manually to avoid a big merge hastle.