[raxxorraxor]

Too complicated, not suitable for everyday authentication in my opinion.

Seriously, the way auth in general is developing right now, I think we approach a point of insecurity through obscurity.

And with applications states, you need to adapt the application logic to authentication and the application then would have to check if someone maybe stole your refresh token.