fixed a bug where all token time to live values in the authorization code grant flow were set to the same value as that of the refresh token