v0.2.1: fix sign-outs after a dropped refresh response

Fixed

• Connected clients could be signed out with "auth failed" after a network blip. Refresh tokens rotate, and a client
  that presented its previous token more than a minute after a refresh was treated as replaying a stolen token, which
  revoked its whole sign-in. When the refresh response is lost in transit (a dropped connection or a hosting-provider
  incident), the client never receives the new token and retries with the old one. The previous token is now accepted
  as a retry until its replacement is first used; only a token two generations old ends the sign-in.