Fixed token refresh for clientless access tokens