Introduce refresh tokens and expirable access tokens.

This supersedes #230.

I will explain what's going on in this PR later. I've gotta run now :-P
> Actually I think it's better to have it separated. 

Sure but let's add a more descriptive message (e.g. the ``A new access and refresh token granted for a valid refresh token.``)