so only the access token is sent in all requests. And the refresh token is sent only in the refresh session request.