Improve the logic of extracting refresh_token from the token endpoint response

[ldclakmal]

Description:
The logic of extracting refresh_token from the authorization endpoind response should be improved based on the grant type. Because the refresh_token property may be or may not be there depend on that.

[ldclakmal]

This is a bug. The optional refresh_token property which is sent by refresh endpoint should replace the existing refresh_token property set by the user in oauth2:RefreshTokenGrantConfig record. This scenario is very rare because normally the refresh_token is a long-lasting credential.

According to the RFC Section-6, https://tools.ietf.org/html/rfc6749#section-6

The authorization server MAY issue a new refresh token, in which case
   the client MUST discard the old refresh token and replace it with the
   new refresh token.  The authorization server MAY revoke the old
   refresh token after issuing a new refresh token to the client.  If a
   new refresh token is issued, the refresh token scope MUST be
   identical to that of the refresh token included by the client in the
   request.