Add an API method to allow refreshing of the access-token about silverstripe-restfulapi

[colymba]

I can see the security concern about auto refreshing token, but that is left to the dev choice via config.

Also, users can easily refresh their token via the login method. So the refresh method is a bit redundant?

Am not 100% convinced, and it would be great to look at best practices maybe...

[bummzack]

Yes, you can use the login method, but that would mean that I'll have to persist username and password on the client, which I don't like at all.

The refresh-token approach is inspired by OAuth refresh-tokens. And since this is a purely optional addition to the current API, I deemed it worthwhile.

A developer can still choose to:

• use the RESTfulAPI and refresh token using login
• use autoRefreshLifetime to create auto-refreshing tokens
• set the token lifetime to a very high value, so it basically won't expire
• or use the slightly more secure refresh-token approach

It's just about giving more options to the developer.