[Question] refresh flow accept client_id in body where access flow doesn't

Hi,

follow up to my false alarm on #89 , I understood that when using Basic authentication, access flow doesn't accept `client_id` in the body (if present, it overrides the basic auth).

But in the case of refresh flow, there isn't the same kind of "body authentication" management.

Is that normal?