Do not delete all refresh tokens at once. User could have multiple clients authenticated.
Reuse refresh token stored in request object