Allow for requests to specify a timeout

By default requests has no timeout, this is risky when using it from a server backend. Similar to the verify that got exposed recently, this adds a timeout parameter, which defaults to the requests default of None, to refresh_token and fetch_token.