When the kid carried by a token cannot be found in the cache, a forced refresh should be triggered rather than directly rejecting the request, in order to handle the race window during key rotation.