# refresh_token is required in either the json payload or cookie