Extra secret check for refresh_token grant type