Make it possible for confidential clients to refresh tokens.  

Also, update the web sample app to use the current middleware that has been separated from the core express package.