fix AccessToken refresh() bug

How did this pass the tests?
Bumped version