How to use refresh tokens with a self-hosted login