Restructures authentication logic

[simonbs]

This PR restructures our authentication logic in preparation for supporting guest users. At a high level the following changes were made:

• Moved authentication code into subfolders to provide a better overview.
• Reading and refreshing tokens is now performed through AccessTokenService instead of separate types.
• With the introduction of AccessTokenService follows LockingAccessTokenService and OnlyStaleRefreshingAccessTokenService. Both are decorators over IAccessTokenService.
• SessionDataRepository has been removed as it is largely unnecessary.