refs: fix leak on successful update

Free the old ref even on success.