Add refresh token to authorization response