added refresh token logic
make scopes optional when refreshing an access token
delete refresh token when successfully used
remove old refresh tokens in save_bearer_token method (more accurate)
fix 'n' docs