persisting refresh token on the Authorization server option