Introduce refresh tokens and expirable access tokens.

This supersedes #230.

I will explain what's going on in this PR later. I've gotta run now :-P
this should probably be similar to https://github.com/Gizra/restful/pull/264/files#diff-abd9682b8385b07fcce127457f696054R77