Refresh tokens should be removed from cache, either when there are too many or when they are older than x days.