fix AccessToken refresh() bug

How did this pass the tests?