correcting endpoint for extending short-lived access tokens

see issue #127