fixed comparison of client IDs in refresh token, closes mitreid-connect#752

Also addresses mitreid-connect#735 (again)

Author: jricher

openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/DefaultOAuth2ProviderTokenService.java

@@ -213,7 +213,7 @@ public OAuth2AccessTokenEntity refreshAccessToken(String refreshTokenValue, Auth
 
 // make sure that the client requesting the token is the one who owns the refresh token
 ClientDetailsEntity requestingClient = clientDetailsService.loadClientByClientId(authRequest.getClientId());
-if (requestingClient.getClientId() != client.getClientId()) {
+if (!client.getClientId().equals(requestingClient.getClientId())) {
 tokenRepository.removeRefreshToken(refreshToken);
 throw new InvalidClientException("Client does not own the presented refresh token");
 }