Go stateless, let the client retain the refresh token instead.