perform background refresh of tokens

[superfell]

This triggers a background refresh of the token once the token has less than 60 seconds left before it expires. In addition, it re-works the refresh lock to be either a single lock (as before) or a per scope lock, based on what the ServiceAccount implementation does.

fixes #90