Do I need to trigger the refresh of a token myself? at the moment the refresh url is never used and thus the access token expires (gets removed from cookie storage by the browser due of expiry)