Refresh_token is stored in cookie when using azure oauth

[arnemorten]

Is your feature request related to a problem? Please describe.
After the recent release of chainlit (f308392) the refresh_token gets stored in the User object which is written to the JWT that is stored in the cookie in chunks as accesstoken_0 and accesstoken_1. I believe this isn't the best security practice and may have CSRF vulnerabilities.

Describe the solution you'd like
I think the refresh token should only be stored in a data layer and not in the User metadata which gets written to JWT.