OAuth providers should consume refresh token and issue a replacement