token refresh fix

Problem description: While access_token is refreshing the method RubyBox::Session.request is called twice with the same request param. That cause twice call of
request.add_field('Authorization', "Bearer #{@access_token.token}")
That lead to wrong header like authorization: Bearer oldaccess_token, Bearer newaccess_token
and failed auth

This fix assures there is no extra header (and also the same for the header As-User)
You are calling the same code in both `if` branches. You can just put it above `if` statement.