refresh token handling, fixes #65