Introduce refresh tokens and expirable access tokens.

This supersedes #230.

I will explain what's going on in this PR later. I've gotta run now :-P
Not sure, but maybe it should be ``getAccessToken``? As ``create`` hints it's an unsaved one?