refresh token should use POST