client headers sent for refresh token operation