Can't refresh token via client call – permission denied