handle session nonce and expired tokens

- when a token expires, attempt to refresh it
- when a session nonce is a mismatch, the session is invalid