A closer look at the refresh token flow