The three requests racing on an expired token is the bug that makes refresh logic feel flaky, so giving the client one owner for renewal is the right fix. Keeping the access rule beside the route in the security chain also makes reviews easier, since the scope check is right where the endpoint is declared. Testing the refused request after a successful login is a good habit, because that's the path most suites never exercise.