Allow refresh token in body

[dominic-ks]

This PR addresses the same topic as the previous #115 (Give refresh_token in JSON response) and #116 (Feature/refresh token flow).

Background

This is an important feature, but the previous PR had several unresolved issues and has been inactive for a while.
While I reviewed the earlier implementation, it was unclear which specific changes were required.
As such, I've taken a simpler, more generic approach starting from scratch.

Summary of Changes

• Backward compatible: Existing cookie-based refresh token handling remains unchanged.
• New token_transport option:
  • cookie (default) → existing behavior (refresh token set as a cookie).
  • body → refresh token is included in the response body, and any existing cookies are invalidated.
    • Token is only sent once, allowing the client to manage it directly.
• Token validation:
  • Server will first check for the refresh token in the request body.
  • If not present, it will fall back to the cookie.

Next Steps

I still need to update:

• README
• Tests

Posting this now for feedback and buy-in before continuing.