Add refresh token

Requests made to the `/token` endpoint should return not only an access token but also a refresh token, allowing clients to obtain a new access token without re-authenticating with API using the client ID/secret pair.

For reference, see https://tools.ietf.org/html/rfc6749#section-1.5.