Use encryption to store access and refresh tokens in client's cookies