This commit handles:
     * Passing ID Token as Bearer token
     * Refreshing of tokens using refresh-tokens
     * Persisting refreshed tokens
     * ability to add arbitrary extra scopes via config
       * this is what enables the cross-client/azp stuff