ChallengeAuthPolicy could cache tokens

[chlowell]

Given that AccessToken includes expires_on, a small performance optimization is possible. The policy could hang on to the last token it received, and forego requesting another while that token is valid.