Before this commit, requesting a new token with a client_id by passing
the old token would not work correctly, and only result in the client_id
being set in the cookie.