Introduce refresh tokens and expirable access tokens.

This supersedes #230.

I will explain what's going on in this PR later. I've gotta run now :-P
Maybe better -- ``$this->assertTrue($result['refresh_token'] && $result['access_token'], A new access and refresh token granted for a valid refresh token.);``

Maybe also worth asserting the refresh_token is a new one?