move refresh_access_token method to private method