Fixes #659 : Change RefreshToken to use ClientId from token
 - made client id readonly
 - updated tests to use client object rather than clientid