Allow for request timeouts to be specified

By default requests has no timeout, this is risky when using it from a server backend. Similar to the verify that got exposed recently, this adds a timeout parameter, which defaults to the requests default of None, to refresh_token and fetch_token.