* use refresh token to refresh access token if expired * change access token duration to 15 minutes * change refresh token validity to 1 week Fixes: 539 Fixes: 236