Add (currently failing) test case for using an expired password reset token.