Refreshes the SAML access token using a valid refresh token from the HTTP-only cookie. Returns a new access token and expiration time. Also issues a new refresh token and updates the cookie. Requires a valid refresh_token cookie. On error, raises UnauthorizedApiException.