[BUG]: late validation of refresh_tokens

[ayush00git]

• refresh_tokens for now are being saved to db just after a successful login, which for now does not covers mfa, as the server now supports mfa as well, so while logging in, access and refresh tokens would be sent to client on the basis of mfa_type associated with his account.
• And try revolving the design around users table for inspecting mfa_type, for now the design revolves around mfa_secrets table for this.