Refresh access token using refresh token.
CSRF token received from login/register response (required for web clients only)
Client type determines how refresh tokens are handled:
web, mobile, desktop Refresh token (required for mobile/desktop clients only)