persistent login

Set the expiry on the auth token to something short like an hour and the refresh token for as long as you'd like. Pass the auth token on all requests and validate it on the back end. When the auth token expires, the server sends back an invalid token message and the client should then request a new auth token passing the refresh token. bbm login lama