What happens if the user closes the browser before the token is refreshed and later opens it again after the token has already expired? Will they need to input their credentials again?