Implement refresh token on top of access token

[rtcharni]

• store refresh token in local storage
• send access token via cookie - http only
• check access token on backend request if exp is in 5-10 min or similar
  • then make new request to get new access token
  • have to send refresh token and access token
    • verify both tokens and send new access token