Test for token approval.

  - Turns out nohost is just a default placeholder - testbrowser can
    encapsulate all the things.
Changelog.