Sessions and tokens

Signing in returns a short-lived access token and a long-lived refresh token. Refresh tokens rotate on every use; if an old one is presented again the whole session is revoked, which is how a stolen token gets caught.