[Question] refresh flow accept client_id in body where access flow doesn't

Hi,

follow up to my false alarm on #89 , I understood that when using Basic authentication, access flow doesn't accept `client_id` in the body (if present, it overrides the basic auth).

But in the case of refresh flow, there isn't the same kind of "body authentication" management.

Is that normal?

Examine the refresh flow implementation in the codebase, likely in modules handling OAuth2 token endpoints. Compare with the access flow to understand why client_id is handled differently. Look for tests related to refresh token grants to see the expected behavior. Determine if the discrepancy is intentional or a bug, and propose a fix aligning both flows.

Scritto dal modello di indicizzazione a partire dal testo della issue.