Why the special treatment of refresh token? I can imagine people wanting to use jwt refresh tokens too. Maybe I'm missing something?