properly handle user authentication with access_token and refresh_token