Fix token refreshment, clean up utilities.

The refresh request wasn’t using HTTP Basic authentication, and the API
request wasn’t being retried with the renewed ID token. Whoops!