fixed token provider flow to actually get a refresh token correctly