Save the refresh token in local storage and only use access token in memory

[philip-gai]

Then when we need an access token again, use the refresh token to get it from the API.

Right now we're storing the access token in local storage.