Passport refresh token if stale

The website session is longer than the token ttl from hydra, so you can be logged in while your token is outdated.
To combat this we need some automatic check if the token is stale and refresh it if possible.

For axios it could look like:
````
instance.interceptors.request.use(config => {
if (token.expired()) {
token = token.refresh()
}

config.headers['Authorization'] = `Bearer ${token.token.access_token}`;
return config;
});
````

open questions:
- what if we cannot refresh? maybe throw an exception that can trigger client redirect to login?
- how to make this globally available? maybe some global axiosClient?
- how to implement this in tiny steps