Automatically refresh access-tokens

[booiiing]

Fixes issue #12.

WARNING: This pull-request depends on #27 and will leave you with broken code if you don't apply both.

By injecting an extended failure-block, the client checks for expiration of the cached token and tries refreshing it.
If a new token can be obtained, the original request is repeated with the new authorization-header.
If no new token can be obtained or something else goes wrong, the original failure-block is called, handing down either the original error or the error that came up when refreshing.

[mattt]

Mixing state and successive asynchronous calls is a recipe for disaster. Again, the whole point of the client's design is to be separate from whatever's making the actual webservice API calls. Refreshing is something the OAuth client does, but it's up to the HTTP client to kick off that process.