If the exchange token should return a refresh token too. Not suitable for client side or JavaScript apps.