Introduce refresh tokens and expirable access tokens.

This supersedes #230.

I will explain what's going on in this PR later. I've gotta run now :-P
This is asserting that when you hit the `refresh_token` resource with the appropriate token you get an access token in return.