Reduce polling to /user/refresh

[chrisknoll]

Add refreshTokenThreshold to limit polling for permissions in Route.js.
Alter polling intervals to use app config settings.

Fixes #2820.

[chrisknoll]

I've updated this PR to create a common executeWithRefresh() method in AuthAPI that will prevent a lot of boilerplate code that I was copying to call the HTTP request and then follow with refreshToken().

Some elements look awkward, but it's because a single function (in most cases: save()) had 2 different paths: in the case it is a create-type of save, it would do a POST + refresh token. In the case of a update-type of save, it would only do a PUT. And then on top of that, there might be additional promise-chain type of activity, that was just too complciated to try to share between each path...so you might see duplicate code, but it's too complicated to share.

@anton-abushkevich : if you could run this branch on your environment and let me know if you see any issues. I would like to include this in 2.14.