Holds jwt as the provider's bearer credential and boots MemberJunction on it. False when the provider
rejected it. onRefresh is how the provider asks for a fresh token when the server says this one is no
longer good; it resolves to the new token, or rejects when there is no way to renew.
True when an authenticated principal is already held (by the host application, or a prior hold).
The provider seam: production configures
GraphQLDataProvider, specs use a fake.