fixed bug in refresh token