access token's expiry, but this would not provide much benefit cause we would still want to enforce the fact that we get a new refresh token for each /refreshSession call.