fixed refresh token handling