Use refresh token or invalidate tokens

[Adrian-St]

Currently our jwt tokens don't expire.
This is not a good practice, because somebody could steal them and authenticate as the user.
We should either use a refresh token or implement an easy way to white list tokens.