I went for what seemed the easiest and cleanest way: a new token will be generated only if/when needed -- aka a subsequent access of `token` property.

The refresh might be superfluos -- even though that is not the case with our current usage, we are granting rights with a reason :smile:.