allow longterm token to refresh

 - add config for duration of longterm key
 - move tokenDuration to helpers for better isolated testing
 - add better logging as to what is going on
 - refresh the longterm token for its original duration e.g. 90 days
Nevermind -- it's only internal.