refresh token works. fix #26