Testing the token payload
Invalid refresh attempts work (or, well, don't)
This can be written shorter
Test refreshes