Referencing auth0.js v 5.2.2

Now when calling refreshToken it will send passthrough as a default scope, making it use the same one as the one used to get the id_token in the first place.

Fixes #101