fix(auth): force logout when mobile refresh is rejected by the token endpoint