Handle refresh keys

When going to the homepage after the access token is revoked, nothing is displayed. The API requests fail because there's no valid token but we have a refresh token. Clicking 'login' refreshes things, but shouldn't be necessary; you may be able to refresh the tokens in the background yourself? https://github.com/simonsobs/soauth/blob/main/docs/introduction.md#nothing-ever-lasts