modified example to use password grant type followed by refresh token grant type