first implementation of token refresh request
have TokenStore handle TokenResponse, rather than Session handling it