https://emtunc.org/blog/11/2017/jwt-refresh-token-manipulation/