turns out you need to set the credentials: "include" option on the fetch call that is expecting a cookie, so i needed to add the credentials: "include" to both the /login request and the /refresh request