Fix code scanning alert - Clear text storage of sensitive information

[apstanisic]

Tracking issue for:

• https://github.com/apstanisic/zmaj/security/code-scanning/3

[apstanisic]

This is not an issue, since I'm never returning raw token. In createSession, I'm creating token, encrypting it, storing raw and returning only encrypted version. I also ensured that refresh token is not returned when showing sessions to user.
There is no point in encrypting same token twice to satisfy this alert

TODO Add refreshToken property as canRead=false, so it's even harder to access it.