Improve security for refresh token.
Update readme.