Add JTI claim to refresh tokens

[smolinari]

Currently we are storing the token itself in cache as our rough session management. The better or rather more proper way to check for valid sessions and to continue the refresh process is to add the JTI (JWT ID) claim to the session token and use that to identify an active session.

So, we should change to this method in the future.

Scott