Make token refresh handling comply with the RFC