So lowering refresh_token_validity will force user to reauthenticate?