There is no way to refresh an access token without revoking the previous access token

[ransombriggs]

Steps to reproduce

Right now there appears to be two possible behaviors when a refresh token is refreshed.

1. If the previous_refresh_token column exists then the refresh token / access token are both revoked when the TokenInfoController::show action is requested for the first time.
   • It would help if the comment describing this behavior were more specific about what "used" means.
2. If it does not exist both the refresh and access token are revoked immediately.

Desired behavior

I was wondering why we revoke both the refresh and access token at the same time when revoked immediately. I would have expected that the refresh token would be revoked, but that the old access token would remain valid until it expired. I had assumed I missed something in the RFC about this but could not find anything. I would try and hack this in, but since refresh tokens and access tokens use the same model + column for revocation it was not straight forward.