if failed there will be always err.

Verify access token, return nil, TokenErrorExpired or other err@todo: maybe store refresh's guid in access token also to check if it's there? It will have access token revoked in refresh token is revoked.