SSO Login: increase lifespan of JSON tokens for cookie-less auth

[squigglybob]

There are security issues with increasing the age of a JSON token as it is a key to access the API. They are meant to be short lived I think.

Something I read mentioned having a refresh token that you could use to request an issue of another auth token, but I'm not sure how that would work if you left a site for weeks before coming back to it.

This will work for cookie based auth like on zume or DT, but PG uses JSON tokens, so we > would need to come up with another way of extending the life of those
Originally posted by @squigglybob in #2537 (comment)