App looks for refresh token: - If one is found at all return it. - Generate a new refresh token if no refresh token is found. - Generate a new token when processing a refresh token request (refresh token endpoint).