fix(cognito): expire refresh tokens and scope them to their own pool in REFRESH_TOKEN_AUTH (#2135)