Introduce refresh tokens and expirable access tokens.

This supersedes #230.

I will explain what's going on in this PR later. I've gotta run now :-P
Actually I think it's better to have it separated. If one ever fails, then we know which one failed of we have 2 different assertions.

> Maybe also worth asserting the refresh_token is a new one?

Added that and an invalid refresh token.