code: def set_refresh_cookies(response, encoded_refresh_token, max_age=None):
      
      if not config.jwt_in_cookies:
          raise RuntimeWarning("set_refresh_cookies() called without "
                               "'JWT_TOKEN_LOCATION' configured to use cookies")
  
      # Set the refresh JWT in the cookie
      response.set_cookie(config.refresh_cookie_name,
                          value=encoded_refresh_token,
                          max_age=max_age or config.cookie_max_age,
                          secure=config.cookie_secure,
                          httponly=True,
                          domain=config.cookie_domain,
                          path=config.refresh_cookie_path,
                          samesite=config.cookie_samesite)
  
      # If enabled, set the csrf double submit refresh cookie
      if config.csrf_protect and config.csrf_in_cookies:
          response.set_cookie(config.refresh_csrf_cookie_name,
                              value=get_csrf_token(encoded_refresh_token),
                              max_age=max_age or config.cookie_max_age,
                              secure=config.cookie_secure,
                              httponly=False,
                              domain=config.cookie_domain,
                              path=config.refresh_csrf_cookie_path,
                              samesite=config.cookie_samesite)
docs: Takes a flask response object, and an encoded refresh token, and configures
      the response to set in the refresh token in a cookie. If `JWT_CSRF_IN_COOKIES`
      is `True` (see :ref:`Configuration Options`), this will also set the CSRF
      double submit values in a separate cookie.
  
      :param response: The Flask response object to set the refresh cookies in.
      :param encoded_refresh_token: The encoded refresh token to set in the cookies.
      :param max_age: The max age of the cookie. If this is None, it will use the
                      `JWT_SESSION_COOKIE` option (see :ref:`Configuration Options`).
                      Otherwise, it will use this as the cookies `max-age` and the
                      JWT_SESSION_COOKIE option will be ignored.  Values should be
                      the number of seconds (as an integer).