fix(api): clean session cookies only for invalid refresh token

[smalluban]

I've checked how the v8 and account-web process rejected requests for refreshing the token with the following code (almost identical code). The code only checks if the response status code is higher or equal to 400.

if (status >= 400) {
  res.json()
    .then((data2) =>
      this._errorHandler(data2.errors)
        .then(() => resolve(data2))
        .catch((err) => reject(err)),
    )
    .catch((err) => reject(err));
}

Moreover, I have not found any code, which cleans up the cookies when refreshing the token fails. We added this because we had a bug in Safari with setting the correct cookie expiration date (some time ago). We can still keep the cleanup, but it should be done only if the server explicitly responds with 400 code - so we are sure that something is wrong with the cookie itself.

Without the fix, if a user loses internet connection on that call, the catch will clean up the session.