Bind refresh tokens to clients

Refresh-token validation checked only the token hash and status, not the authenticated client, so Client A could redeem Client B's refresh token in violation of RFC 6749 section 6.