refresh hook improvements: XSRF protection and passing error_code

- require the expiring access_token on the refresh hook for XSRF
protection
- pass error codes back to the caller in the error_code parameter to the
return URL when the refresh hook fails