[keycloak-user] RPT vs regular access tokens