Allow the token to be refreshed without triggering a reauthentication

[guschnwg]

Summary

When refreshing the token, it was triggering a reauthentication. Since clients should use refresh tokens, when available, this feature is a good way to test that our MCP servers don't trigger unnecessary oauth flows.

https://github.com/user-attachments/assets/5db3a6bd-591b-42fe-a64c-746af61ae6fc

Closes #665