user is undefined after revoking refresh token