A session whose refresh keeps failing now backs off, instead of asking the authorization server again on every page view, every image, and every write for the rest of the cookie's life.