Swap your sign-in token for a fresh one

A person's own web or app JWT (not an api-key, an sld_ or sat_ token, a guest, an agent or a browser-linked sign-in, which keeps its own 7-day rule) is traded for a new one with a new 30-day life. The fresh token comes back in the Authorization header and as token; the old token stops working at once. A token that has already expired cannot be refreshed: sign in again. At most 30 an hour per account.