title: JWT refresh token flow
body: <p>I'm building a mobile app and am using JWT for authentication.</p>
  
  <p>It seems like the best way to do this is to pair the JWT access token with a refresh token so that I can expire the access token as frequently as I want.</p>
  
  <ol>
  <li>What does a refresh token look like? Is it a random string? Is that string encrypted? Is it another JWT?</li>
  <li>The refresh token would be stored in the database on the user model for access, correct? It seems like it should be encrypted in this case</li>
  <li>Would I sent the refresh token back after a user login, and then have the client access a separate route to retrieve an access-token?</li>
  </ol>