userId in RefreshToken is no longer required due to client_credentials grant type