Rotating the refresh tokens.

Use once and rotate —If it's valid yet the access token is not then I prefer to issue a new set of the two.

I have some sense of insecurities with refresh tokens hahaha!