Compose the OAuth2Authentication object out of request and auth.
Generate an expiring refresh token.