Token refresh in browser without redirecting to Hydra/IDP

[impactmass]

Token refresh in browser without redirecting to Hydra/IDP

Summary description

This will be a continuation of #350.
#350 added token refresh via full page redirects (and reloading), but this does not give a good user experience in all cases. E.g in the case of user filling a form and leaving it for long. The refresh can lose all the already filled form contents.

So, it makes sense to also have refresh happen entirely in the browser.

There are approaches to make this work that can be explored. One of them (mentioned in #350) include using a hidden iFrame.

Links:

• https://auth0.com/docs/api-auth/tutorials/silent-authentication
• https://auth0.com/docs/libraries/auth0js/v9#using-checksession-to-acquire-new-tokens

More implementation details should be fleshed out here.