rp_st
sessionHandle userId refreshTokenHash1 expiryTime parentRefreshTokenHash1 antiCsrfToken userPayload (the claims you pass)