"Test that using an expired but correct token doesn't allow the user to revoke their password." 
How should I test that? If I change the $config, it affects the other tests.