refreshToken to accept app_id and app_secret