only include refresh token in token endpoint response (Authorization Code flow)