I could just tied access token jti with the refresh token record, but how I detect if refresh token was stolen if there's just one refresh token stored on database?