make user_id not required for refresh_token grant