Fix auth flow

[roman-koshchei]

Remove default auth behavior.
Make a wrapper for the route handler (as U.CatchUnexpected) to check auth.
If there isn't an access token, check the refresh token. If the refresh token is valid, add a new access token to the handler's response.
If the access token is valid, check the expiration. If the token never expires that means it's a dev token and must be checked from the tokens table. If not it's a website token.