fix: using the refresh token for refreshing the access token