A resolved credential the auth middleware can use; refreshes itself.
Drop cached state and obtain a fresh token (after an unexpected 401).
Returns a valid bearer token, refreshing if expired.
A resolved credential the auth middleware can use; refreshes itself.