refresh token invalidation fixes and invalidation testing