text: Title: Differentiate between an access token and refresh token
  Body: Hi, is there a way for me to differentiate between an access token and refresh token just by the token that's sent in the request? Once a token is revoked / blacklisted, there's nothing stopping the client from sending the refresh token in place of the access token (it has a longer lifetime)—this poses a security threat. 