Refresh token should be optional