When I change a user's role such as commenting out role: admin, the next time the token refreshes they are still admin. After speaking to Viktor I think we should ideally generate a new token on refresh rather than just extending its time.