The capability is incorrectly handled for the JWT service causing it to wrongfully validate if user has the ability to issue refreshable token.