added client check for refresh token