MSC2918: Refresh tokens (#2918)
MSC2918: Refresh tokens (#2918)

* Refresh tokens MSC

* MSC2918: minor changes

* MSC2918: access token expiration as milliseconds

* MSC2918: account registration API changes

* MSC2918: fix `expires_in_ms` example

* MSC2918: add precision about token revocation

* MSC2918: specify error codes for the refresh API

* MSC2918: clarify that the change also applies to ASes

* Apply suggestions from code review

Co-authored-by: Richard van der Hoff <6e2e234be92ed8dc85f875dbc2f9b6424da7a211@users.noreply.github.com>

* MSC2918: clarify what problem this MSC solves

* MSC2918: minor formatting and rephrasing

* MSC2918: clarify ratelimiting, masquerading and authentication on refresh token API

* MSC2918: make expires_in_ms/refresh_token optional

* MSC2918: soft logout in refresh token API

* MSC2918: add detailed rationale

While not exhaustive, it outlines a few attack vectors this MSC tries to
mitigate.

* MSC2918: minor fix

Co-authored-by: Hubert Chathi <394623d3491514d47f1279a4d0ef0068741e3017@uhoreg.ca>

* MSC2918: clarifications on backward compatibility

* MSC2918: advertise support in the request body

* MSC2918: clarify on what happen when token expire

* MSC2918: remove redundant precision about token expiration and lifetime

Co-authored-by: Richard van der Hoff <6e2e234be92ed8dc85f875dbc2f9b6424da7a211@users.noreply.github.com>

* MSC2918: minor clarification

* MSC2918: soft logout when using expired token

Co-authored-by: Richard van der Hoff <6e2e234be92ed8dc85f875dbc2f9b6424da7a211@users.noreply.github.com>
Co-authored-by: Hubert Chathi <394623d3491514d47f1279a4d0ef0068741e3017@uhoreg.ca>
matrix-org/matrix-doc,matrix-org/matrix-doc,matrix-org/matrix-doc,matrix-org/matrix-doc