Improved refresh token so the findOne query looks for both the token AND the clientId.