from what I understand, you are attempting to delete the old refresh token at the time the new one is issued. If this is correct, you will eventually run in problems where the old one is revoked and the new one doesn't reach the client (network issues...) and your user is logged out.