bugfix: correct handler for refresh token grant