RefreshTokens are generated too often

[sherlock1982]

Very nice and neat example, thanks!

The only thing I want to notice is that normally refresh happens every hour (in this example 15 minutes). There's no need to generate a new token on each refresh as there will be just too many of them.

Maybe better to update existing token with some fields like Updated and UpdatedByIp ? Initially set together with Created and CreatedByIp. Because if the request is valid it is still ok to reuse the same record.