Add new test: test_cannot_use_expired_token

Trying to reset password using an expired token results in an exception.
After that, the old password is still valid, the new one invalid.