Browsing: invalidate refresh token