Fix refresh token payload structure on shared refresh (#10875)

Fixes #10822

api/src/services/authentication.ts

@@ -321,6 +321,10 @@ export class AuthenticationService {
 				collection: record.share_collection,
 				item: record.share_item,
 			};
+			tokenPayload.app_access = false;
+			tokenPayload.admin_access = false;
+
+			delete tokenPayload.id;
 		}
 
 		const customClaims = await emitter.emitFilter(