Changes to auth code

[wbazant]

Closes #615
Closes #614
Closes #613
Closes #599
Closes #565

I tested this a bit with my account. I also tried to make an account with a temp email hwkocmuhkquxswlblp@hthlm.com from 10minutemail, but the confirmation never arrived.

[ezwelty]

@wbazant This is epic! I worked through the linked issues and found the reported behaviors to be fixed, except for #615 where I wasn't sure how to reproduce the problem on the live site or what exactly the problem was.

#615: Proposed resolution is to try refresh the token if the token is expired (not sure how to test that just on client side)

The API returns an expires_in (seconds). If needed, I could also add the exp attribute (expiration timestamp).

I also tried to make an account with a temp email hwkocmuhkquxswlblp@hthlm.com from 10minutemail, but the confirmation never arrived.

According to Postmark logs, a confirmation email was sent twice to that email on November 26. Are you sure you didn't receive it? If you have a gmail account, you can append '+...' before @gmail.com to create multiple accounts from the same email. (As I write this, I wonder whether this is a bug or a feature, but I see nothing a priori wrong with someone having multiple accounts).