Verify the client on refresh token endpoint (#2)