Test that using an expired but correct token doesn't allow the user to revoke their password.