migrate to new strava authentication

[casperdcl]

"short-lived access tokens" and "refresh tokens" are replacing "forever tokens".

This means strava-box stops working 6 hours after STRAVA_ACCESS_TOKEN is set in Circle-CI.

• http://developers.strava.com/docs/authentication/
• http://developers.strava.com/docs/oauth-updates/#migration-instructions