Use JWT for refresh tokens

Overview

Currently the refresh tokens issued from mod-authtoken are encrypted (JWE). I'm not sure that's necessary as there doesn't appear to be anything sensitive/secret in the token itself. Unless there's a compelling reason to encrypt these, I suggest we save the time/resources on the extra crypto and forego the use of JWE.

See wiki for additional details

Acceptance Criteria

• Refresh tokens are signed, but not encrypted
• (Optional) Allow encryption to be turned on via configuration