Fix refresh for static site scenario

[ottokruse]

Issue #, if available: #285

Description of changes: Changed the way refresh works so that it also works in static site and other scenario's where checkauth handler cannot "see" the refresh token cookie--if it was limited to be sent to the refresh path only. Instead we now try the refresh always. To prevent an infinite loop in case refresh would fail, we rely on the presence of a marker cookie.

Success scenario:

1. at requested path: check JWT, if JWT expired --> redirect to refresh path
2. at refresh path: attempt refresh --> OK --> set new JWTs in cookies, redirect back to requested path
3. at requested path: check JWT, now OK

Refresh fails scenario:

1. at requested path: check JWT, if JWT expired --> redirect to refresh path
2. at refresh path: attempt refresh --> Failure --> set marker cookie "refresh failed", redirect back to requested path
3. at requested path: check JWT, still expired, but marker cookie "refresh failed" present, so --> redirect to Cognito Hosted UI for sign in

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.