Not sending a refresh_token to public clients requesting password_grants