more major refactoring of access tokens and refresh tokens