Fixes #19 : only refresh token on Forbidden access