Refresh Token

Exchange a refresh token cookie for a fresh access token, rotating the refresh token.

Verification reads through the writer session: every exchange stamps a new jti on the system user, and the next exchange has to observe that write to accept the token it just handed out.