Refresh_token should not be included in Client Credentials Grant

[visvk]

A refresh_token is being returned when using the Client Credentials Grant.

It should probably be removed from this grant type to better adhere to http://tools.ietf.org/html/rfc6749#section-4.4.3

4.4.3.  Access Token Response

   If the access token request is valid and authorized, the
   authorization server issues an access token as described in
   Section 5.1.  A refresh token SHOULD NOT be included.

[thomseddon]

👍 Good spot

[CrisFavero]

+1
Additionally it would be nice to generateRefreshToken to allow for optionally not including a refreshToken. Perhaps rather than checking for falsey using !token in token.js it could specifically check if it is false rather than null.

[facultymatt]

Getting the same failure here.

I've configured my app to use all 4 grant types. However in cases there I use client credentials, and don't want a refresh token, the below check doesn't work (since this.config.grants does contain refresh token)

if (this.config.grants.indexOf('refresh_token') === -1) return done();

It would make sense to check both this.config.grants AND the current method.