support refresh tokens

after we merge sip authentication, I'd like to define how bonafide v3 will handle refresh tokens, for how long will they live, etc, and their relationship with vpn certificates. we should document this somewhere.