Refresh the access token

Rotate the dashboard session from its httpOnly refresh cookie. Cookie-authenticated only — an API key neither needs nor can use this. A session whose sign-in was started by a client presenting an API key (see POST /api/v1/auth/sessions and POST /api/v1/accounts) is renewed only while that key is live; once it is revoked or expired the refresh answers 401 refresh_token_revoked. The original sign-in time carries over to the renewed session.