Retain refresh token expiry on refreshing

[chrisirhc]

Right now, on refreshing tokens, the refresh token becomes treated as never expiring since the refresh_expires* properties are not persisted on refresh.

• Also add support for refresh_expires_in (See Add support for refresh_expires_in #358)

[sqrrrl]

Appreciate the fix as it does seem like there's a bug there. There's a few issues per comments.

Suggest approach this a little differently:

1. instead of saving granted_time, which is ambiguous with two different expiries in play, convert expires_in/refresh_expires_in to expires_at/refresh_expires_at in parse_token. This way we have always have both fields as absolute times.
2. Update the expiration checks to first check for the new fields, fall back on the old checks for existing tokens/migration.
3. Update the refresh method to make sure expires_at/refresh_expires_at are propagated to the new token if omitted in the server response. Can also handle migration here too and convert refresh_expires_in to refresh_expires_at.

That's a bit more work, but eventually should allow the expiration checks to be simplified later on after users have a chance to migrate.

The alternative would be to update parse_token to record a new refresh_token_granted_at timestamp if a refresh token is present, then propagate that + refresh_expires_in as discussed + update the refresh expiry checks appropriately.

[chrisirhc]

Updated PR based on comments.
Please take a look.

[chrisirhc]

Did another pass and addressed the changes as well as added tests.