Test that using an empty token doesn't allow the user to revoke their password.