Refreshes itself when under 3 minutes remain, and once on a 401. The token stays in this tab only. Agent on the renew call is the JWT sub, falling back to the agent field.