Implement refresh token on top of access token

- store refresh token in local storage
- send access token via cookie - http only
- check access token on backend request if exp is in 5-10 min or similar
  - then make new request to get new access token
  - have to send refresh token and access token
    - verify both tokens and send new access token