Right now it's hardcoded to always return a refresh token when you issue an access token. Should think about making this an optional workflow or committing to it being turned on indefinitely.