Use a refresh token instead of an access token