Fixes #44 by assuming only confidential clients get refresh tokens