now after token refresh, user info is still available