Stripping Refresh Tokens from OAuth Flow