I am wondering if we need to also log the hash of the refresh token. Technically, it is possible that the returned refresh token was bad and if this happens, we want to find the correlation id of the request that led to such bad refresh token. What do you think?