[refresh-token] rename to JWT_ALLOW_REFRESH