Add token refresh middleware.

Create a restrict middleware for ensuring that there is a proper v1
access token cookie set.
Handle the case where a refresh token is present, but not an access
token.