fix(auth): refresh token before expiration, use locks while refreshing

fix(auth): refresh token before expiration, use locks while refreshing #10953