Add test for unique tokens

- basic sanity check that for the same password a unique token is always
  returned. This tests the token generation end to end.