Also, your refresh API can literally look like this:

app.post("/refresh", supertokens.middleware(), (req, res) => {
    res.send("");
});

That is, you don't need to call supertokens.refreshSession yourself.