alternatively, you can have a hard limit such that even if the user is active, when that hard limit is reached, rotating the refresh token would fail