Add silent auth support

[DarkoKukovec]

Breaking change

No

Description

Refresh the tokens in the background

[ymajoros]

The goal is of course to have the authorization code never reach the main app.

The way I experimented with was something like this:

• main app creates an iframe with the authorization endpoint as src
• if authentication is succesful, the service worker intercepts the result and redirects the iframe before answering ( redirect in the response) so that it never sees the url with the code (maybe possible even without redirect)
• make sure CSP is set up so no inline script can be run in an iframe or other web contexts to avoid XSS