How do refresh tokens work in the presence of concurrent requests from multiple tabs? I don't see how two tabs could synchronize their access in a way that won't lead to the possibility of one tab thinking it has been logged out. I guess you can try and paper of these issues with JS but without client side JS you are completely lost.