Allow refresh tokens in client credentials grant

Fixes gh-132