title: how does authorization code flow return permanent access token?
body: <p>the client is console application,when login it shows a login url,the user need copy it to web browser to go on,after successful login,the browser shows a authentication code,the user copy it back to client and paste here,then client exchanges the code for token,the resulted token contains refresh token,but I do not save the refresh token because of security concerns,such that I need the access token's period of validity to be unlimited.</p>