support for refresh_tokens; clean up authentication logic