Multiple improvements for April 2025

* Improve refresh token handling in the background.

Resolves issue when user opens the website, allows the access token to expire, but continues browsing.
The background requests are failing with CORS errors to OIDC provider.

* fixup! Improve refresh token handling in the background.

* Abstract the token blacklisting.

jwt.go

@@ -15,8 +15,10 @@ import (
 	"time"
 )
 
-var replayCacheMu sync.Mutex
-var replayCache = make(map[string]time.Time)
+var (
+	replayCacheMu sync.Mutex
+	replayCache   = make(map[string]time.Time)
+)
 
 func cleanupReplayCache() {
 	now := time.Now()
@@ -164,6 +166,7 @@ func (j *JWT) Verify(issuerURL, clientID string) error {
 
 	return nil
 }
+
 func verifyAudience(tokenAudience interface{}, expectedAudience string) error {
 	switch aud := tokenAudience.(type) {
 	case string: