C503 Replaces rotated refresh tokens

What this test does

Every refresh returns a new refresh token.

How it passes

Your client uses the newest one. Using an old one is a failure.

Specification

§5.5

Needs

C502 Refreshes expiring tokens