Created forward refernces for auth tokens.

Authorization tokens that have been refreshed will have a reference to their refreshed token's access code. This means that someone may "refresh" a token many times and get back the same "new" token. However, once the "new" token is refreshed, the original token can no longer be refreshed. This fix is based on a phone that loses connection during a refresh and needs to replay it and get back the same "new" token.

Closes #639