add tenantId to refresh token

also skip user mod time check for refresh_token_grant