Move authentication code out of timetable.js, add support for refreshing tokens

hi #5