$ curl -X POST /api/auth/login  (alice)
{"access_token":"eyJraWQiOiJMeX...","refresh_token":"FeHO52BY0danWV...","token_type":"Bearer","expires_in":300}

$ curl /api/me  (Bearer access token)
{"sub":"alice","sid":"c9ddb06a..."}
HTTP 200

$ curl -X POST /api/auth/refresh  (token A)
{"access_token":"eyJraWQiOiJMeX...","refresh_token":"zgB_rx1Kaqu_AZ...","token_type":"Bearer","expires_in":300}

$ curl -X POST /api/auth/refresh  (token A again: the replay)
{"error":"invalid_grant","error_description":"The refresh token is not valid"}
HTTP 401

$ curl -X POST /api/auth/refresh  (token B, the innocent holder)
{"error":"invalid_grant","error_description":"The refresh token is not valid"}
HTTP 401