make sure a revoked access_token can be refreshed