refresh token without asking for credentials when using passive auth