refresh tokens are hashed and stored in the db.