refactored refreshAuth to run serially so multiple token posts are avoided