Made /render look up both access tokens and refresh tokens.