auth: return ErrInvalidToken on getPasswordToken when token is unknown
auth: prevent password tokens from being reused
app: fix token related tests