Fixes missing authorization header in refresh action.