Given this special case, it would be far safer to copy the new refresh token into the existing auth object and save that back out... I don't think trusting data.auth to be the complete same auth object passed into self is totally safe.