fix Session.refresh_token! to return #user object