auth.js does not handle refresh tokens

The NPR-One API specifies an expiration value for device tokens. Auth.js stores the value once after the device is authorized the first time and never updates the value or checks it again. After the token expires, you'll get 401 errors indicating Unauthorized Access.

The workaround is to delete the npr-one file with the token and re-authorize the device.

Auth.js needs to check every time and handle the response per: https://dev.npr.org/guide/services/authorization/#refresh_token

Start in auth.js by tracing how the device token and its expiration value are stored and reused. Read the linked NPR authorization guide before following the authorization and API-response flow. Done means expired device tokens are checked and refreshed according to the documented response, without requiring deletion of the npr-one token file.

Written by the indexing model from the issue text.