implemented removal of access_token and refresh_token from authorization