Consider auto approved scopes when deciding whether refresh tokens are valid

[#44564885]