Include refresh token's last 4 chars in exception msg

When throwing an exception in response to a failed attempt to use a refresh token, the exception's getMessage() will include the last four characters of the refresh token. This can sometimes be useful in debugging problems.