no need to use ORM when testing response_type=refresh_token