Can you check the case for refresh token with wrong userid as well?