Per Spec, allow Authorization Server to -maybe- issue a new Refresh Token.

 The authorization server MAY issue a new refresh token, in which case
   the client MUST discard the old refresh token and replace it with the
   new refresh token.  The authorization server MAY revoke the old
   refresh token after issuing a new refresh token to the client.  If a
   new refresh token is issued, the refresh token scope MUST be
   identical to that of the refresh token included by the client in the
   request.

This commit allows users to specifiy the time before the Refresh Token
expire time to issue a new Refresh Token.
I just noticed something and provided feedback. It’s up to Alex either way. It could well be that assertTrue(array_has_key()) is used elsewhere, but it probably shouldn’t be. :)