access to refresh_token and device_data from top level session