Add refresh token functionality to Auth API