fixed JWT token refresh logic where refreshing access token made refresh token lost