Authorization_code, client_credential, and password grant types all make an assignment of request.client_id = request.client.client_id, e.g.

This is missing from the refresh_token grant type, which causes downstream problems for code that expects a client_id to be populated.