Add test to ensure that requests with too-short tokens are rejected gracefully