Put username in refresh token and check usernames match when refreshing a token

[louise-davies]

Description:
@VKTB pointed out that currently, any refresh token can refresh any access token, so if a user with a valid refresh token got someone else's access token, they could refresh it and be given a new valid access token with the other user's credentials. We should put the user's username in the refresh token, and then do a check in the refresh endpoint to check if the refresh token's username matches the access token's username before issuing a new access token.

Acceptance criteria:

• Username is in the payload of a refresh token
• Refresh tokens can only refresh access tokens which match their username

[louise-davies]

We should also maybe check they're still a valid user via LDAP...