Check approvals before issuing a new refresh token

Only issue the token if all the requested scopes have
unexpired approvals made before the refresh token was issued.

[#42875031]
[#42984673]