Test that using a wrong token doesn't allow the user to revoke their password.