Lots of small updates based on PR feedback

pkg/oidcclient/login.go

@@ -813,6 +813,7 @@ func (h *handlerState) handleRefresh(ctx context.Context, refreshToken *oidctype
 	refreshed, err := upstreamOIDCIdentityProvider.PerformRefresh(ctx, refreshToken.Token)
 	if err != nil {
 		// Ignore errors during refresh, but return nil which will trigger the full login flow.
+		h.logger.V(debugLogLevel).Info("Pinniped: Refresh failed.")
 		return nil, nil
 	}
 

pkg/oidcclient/login_test.go

@@ -513,6 +513,7 @@ func TestLogin(t *testing.T) { // nolint:gocyclo
 			wantLogs: []string{
 				`"level"=4 "msg"="Pinniped: Performing OIDC discovery"  "issuer"="` + successServer.URL + `"`,
 				`"level"=4 "msg"="Pinniped: Refreshing cached token."`,
+				`"level"=4 "msg"="Pinniped: Refresh failed."`,
 				`"msg"="could not open callback listener" "error"="some listen error"`,
 			},
 			// Expect this to fall through to the authorization code flow, so it fails here.