use refresh token when necessary