Fixed refresh tokens with confidential clients