Refresh token for other webId is used

[ylebre]

Metro-oidc stores information about the webId, refresh tokens etc in localstorage.

The flow is something like this:

• I log in using the webId for Alice.
• access tokens, refresh tokens for Alice are stored in the localStorage.

A day later, I visit again. I start logging in with the webId for Bob.

• The webId for Bob is stored in local storage.
• Localstorage seems to be checked, it has a refresh token available (which is the refresh token for Alice!)
• The token is refreshed, new accesstoken is saved in localStorage (which is an access token for Alice!)

I expected a clean new flow to happen if I am using a 'new' webId. The access token, refresh token should be associated with the webId logging in and only used for that webId.