Error: `the requested scope is not available` with scope=full+refresh_token in User Agent OAuth Flow
OAuth 2.0 User-Agent flow, why is it okay to keep the refresh token when it is considered unable to protect the secret