fixing issue where clientSecret was required during refreshes