Include refresh token's last 4 chars in exception msg

When throwing an exception in response to a failed attempt to use a
refresh token, the exception's getMessage() will include the last four
characters of the refresh token. This can sometimes be useful in
debugging problems.
Merge pull request #218 from mmorearty/masked-refresh-tokens

Include refresh token's last 4 chars in exception msg