handle session nonce and expired tokens

- when a token expires, attempt to refresh it
- when a session nonce is a mismatch, the session is invalid
Merge pull request #12 from jclem/session-sync-nonce

handle session nonce and expired tokens