Fixes #659 : Change RefreshToken to use ClientId from token

 - made client id readonly
 - updated tests to use client object rather than clientid