* ensure we can use the refresh token if required
 * add debug
 * reduce timeout if user doesn't grant access