Once you add that and bodyParser, then the refresh call will yield a 200 and not 404. And the frontend SDK should then again call the original API which should then return 200 since a new sAccessToken is available