no more hardcoded stuff + some refresh token testing