Issue a refresh token on token refresh

When a refresh token is used successfully, a new refresh token should be
issued with the new access token.