Handling cookies is a minefield

Refresh vs. Long-lived Access Tokens (2023)