Do we want to invalidate token... or refresh token? ... invalidation will just defer the refresh.