Add missing spec for UserManager (when drop_token is true)