OAuth2 supports expiring and refreshing access tokens. Need to support this feature.