A flexible token session manager for handling access/refresh token pairs with automatic refresh and cross-domain support