zf-fr/zfr-oauth2-server — pull request #26 by ojhaujjwal (2014-09-05 10:34:16+00:00)
Title: Refresh token grant not allowed to public clients

According to the spec, refresh token grant is not allowed to public clients. See http://tools.ietf.org/html/rfc6749#section-1.5 and http://stackoverflow.com/questions/3487991/why-does-oauth-v2-have-both-access-and-refresh-tokens

If somebody is already using this grant, I think they are in big trouble.