Refresh an authentication token

Exchanges a previously issued token for a fresh one without re-sending credentials. The old token is invalidated. Returns 401 Unauthorized for a bad old_token.