Make it possible for confidential clients to refresh tokens.  

Also, update the website sample app to be compatible with express now that some express middleware has been broken out.