`resource=` parameter in the refresh token grant should match that of the original authorization code grant

[Kehrlann]

Follow-up to #31

When an access token is requested for resource x using the authorization_code grant, then a refreshed token should only be able to request resource x. When using resource=y in the refresh grant, the request should fail