handleRefreshTokenRequest: if set, scope must be the same as the previous token