41 random jwt signature verification failed error

[longshuicy]

• Add Depends(get_current_user) to each protected route. When session expired, decode_token still works but userinfo will complain about expired signature (suspect related to user session expiration). To unify their behavior, check userinfo
• Change frontend action to logout user properly when refresh failed.
• Note don't set the session idle time to a small value. The minimum of those four will decide the life span of refresh token. If set too small this will cause refresh token expiration too soon and can never refresh; and other weird behaviours

[tcnichol]

Everything seems to work as intended here.

[longshuicy]

Ready to be reviewed again