Can you clarify how OAuth2 token refresh mechanisms work so I can explain it clearly to the junior developers on my team during Monday morning standup?