scrub all OIDC_ headers
store the refresh_token if returned from the token endpoint
document refresh_token handling in ChangeLog
use global locking for the Redis cache