t.Run("should fail token refresh with `access_denied` if legacy refresh hook denied the request", func(t *testing.T) {
                        run := func(hookType string) func(t *testing.T) {
                            return func(t *testing.T) {
                                hs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
                                    w.WriteHeader(http.StatusForbidden)