feat: add support for opaque refresh tokens

[tobiasdcl]

fixes #195

[jasonraimondi]

Great thank you! Also thanks for reminding me about the ??= operator, definitely will be using that one in the future. Admittedly I am going to remove it from this codebase because I think the if block is a bit more explicit, and I think explicit in an auth library is better.