Require refresh token when committing OAuth accounts.

Don't know how this could happen, but in the immediate future failing with a
KeyError seems better than silently committing a null value.