Login lost every time browser is reloaded

[mathiasconradt]

Yes, that is correct. renewTokens() then invokes checkSession(), which is what I referred to above (silent authentication), like in this example.