WIP: Introduce refresh tokens and expirable access tokens.

This supersedes #230.