Fix for refresh tokens

[me0s]

Refresh tokens include a did property (device identifier).
If this value is an empty string, the /auth/token endpoint returns a 401 Unauthorized error:

{
  "error": "BadCredentialsException",
  "errorMassage": "Token id is invalid"
}

Providing any non-empty hostDeviceId during login ensures that the did field is set in the refresh token, allowing token refresh to succeed.

This should fix:
#48 and #51