client_credentials should not generate a refresh token

fixes #31